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MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION 

TECHNOLOGY,  AND  LOGISTICS 


SUBJECT:  Audit  Report  on  Controls  Over  the  DoD  Purchase  Card  Program 
(Report  No.  D-2002-075) 


We  are  providing  this  report  for  review  and  comment. 

The  Director,  Defense  Procurement  provided  a  consolidated  response  to  the 
draft  report.  DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved 
promptly.  Therefore,  we  request  that  the  Director,  Defense  Procurement  provide 
additional  comments  for  recommendations  11  and  12. c  by  April  30,  2002. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Dennis  L.  Conway  at  (703)  604-9158 
(DSN  664-9158)  (dconway@dodig.osd.mil)  or  Ms.  Kathryn  M.  Truex  at 
(703)  604-9139  (DSN  664-9139)  (kmtruex@dodig.osd.mil).  See  Appendix  E  for  the 
report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


David  K.  Steensma 
Acting  Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General,  DoD 


Report  No.  D-2002-075  March  29,  2002 

(Project  No.  D2001FG-0068) 

Controls  Over  the  DoD  Purchase  Card  Program 
Executive  Summary 


Introduction.  The  first  Government-wide  purchase  card  contract  was  awarded  by  the 
General  Services  Administration  in  1989  and  DoD  entered  the  program  at  that  time. 

On  October  13,  1994,  the  President  of  the  United  States  issued  Executive  Order  12931 
to  increase  the  use  of  purchase  cards  for  actions  under  $2,500.  Purchases  under  $2,500 
were  chosen  partly  because  these  types  of  buys  were  generally  less  complex  and  did  not 
require  extensive  procurement  knowledge;  and  goods  were  often  available  for 
immediate  delivery. 

Between  FY  1996  and  FY  2001,  over  300  audit  reports  identified  a  wide  range  of 
implementation  problems  in  the  DoD  Purchase  Card  Program.  Nevertheless,  the 
program  remained  an  important  part  of  DoD  acquisition  streamlining  efforts. 

Objective.  Our  objective  was  to  evaluate  the  issuance  and  use  of  purchase  cards  and 
the  controls  over  the  processing  of  purchase  card  payments.  We  also  reviewed  the 
overall  management  control  program  as  it  related  to  the  purchase  card  program. 

During  our  review,  we  examined  the  controls  for  issuing  and  using  231,856  purchase 
cards.  We  also  selectively  reviewed  the  controls  over  the  processing  of  more  than 
10.6  million  purchases  amounting  to  $6.1  billion  in  FY  2001 .  In  addition,  we  reviewed 
over  12,000  convenience  checks  totaling  in  excess  of  $27  million. 

Results.  The  Purchase  Card  Joint  Program  Management  Office  needed  to  improve 
oversight  and  management  controls  over  the  231,856  purchase  cards  in  use  and 
10.6  million  purchases  made  in  FY  2001.  Improved  controls  were  needed  over: 

•  selecting  cardholders  (29,120  purchase  cards  were  unused  for  6  months), 

•  assigning  approving  officials  (3,463  approving  officials  oversaw  more  than 

7  cardholder  accounts  each  and  3 1  of  these  approving  officials  oversaw  more 
than  100  cardholder  accounts), 

•  setting  of  spending  limits  (6,533  cardholder  accounts  had  a  monthly  spending 
limit  of  over  $100,000), 

•  transactions  at  blocked  businesses  (over  $4  million  in  transactions  appeared  to 
have  been  made  at  businesses  that  should  have  been  blocked  by  the  bank  as 
inappropriate), 

•  purchases  declined  by  banks  (687  cardholder  accounts  had  10  or  more  declined 
purchases  in  a  month). 


•  purchases  made  after  card  accounts  were  closed  (transactions  occurred  on 
390  closed  accounts  in  a  month),  and 

•  management  of  convenience  checks  (248  of  12,008  checks  written  in  a 
20-month  period  exceeded  the  $2,500  authorized  limit). 

These  conditions  did  not  necessarily  mean  that  fraud,  waste,  or  mismanagement  of 
purchase  cards  or  checks  had  occurred.  Some  conditions  could  be  data  entry  errors, 
but  the  absence  of  internal  controls  increases  the  risk  for  fraud,  waste,  or 
mismanagement.  Although  identified  misuse  was  small  in  comparison  to  the  volume  of 
annual  purchases,  controls  were  not  robust  and  only  through  more  proactive  oversight 
can  the  DoD  ensure  the  integrity  of  the  program.  For  details  of  the  audit  results,  see 
the  Finding  section  of  the  report.  See  Appendix  A  for  details  on  the  management 
control  program. 

Management  Actions.  During  the  audit,  the  Director,  Defense  Procurement  and  the 
Director,  Purchase  Card  Joint  Program  Management  Office  took  corrective  actions  to 
strengthen  controls  over  the  purchase  card  program.  In  particular,  controls  pertaining 
to  the  supervision  of  cardholders  and  restricting  purchases  from  inappropriate 
businesses  were  strengthened.  In  addition,  the  Director,  Defense  Procurement 
requested  assistance  from  the  Inspector  General,  DoD,  in  obtaining  audit  results  on  the 
purchase  card  program  to  assist  in  managing  the  program,  tracking  fraud,  and 
identifying  trends  of  misuse.  Further,  on  March  12,  2002,  the  Under  Secretary  of 
Defense  for  Acquisition,  Technology,  and  Logistics  and  the  Under  Secretary  of 
Defense  (Comptroller)  issued  a  joint  memorandum  that  emphasized  the  need  for  all 
DoD  organizations  to  maintain  adequate  internal  review  programs  and  to  investigate 
potential  abuse  of  the  purchase  card  and  take  appropriate  corrective  and  disciplinary 
actions. 

On  March  27,  2002,  the  Under  Secretary  of  Defense  (Comptroller)  held  a  press 
conference  to  highlight  actions  directed  by  the  Secretary  of  Defense  to  strengthen 
controls  over  purchase  cards.  These  actions  included  the  creation  of  a  taskforce  to  be 
lead  by  the  Comptroller  to  improve  management  of  credit  cards  by  punishing 
wrongdoers,  developing  reforms,  improving  training,  and  ensuring  that  senior 
management  enforce  controls  of  credit  cards.  The  taskforce  recommendations  for 
proposed  legislation  and  administrative  changes  needed  for  improvement  are  expected 
within  60  days. 

Summary  of  Recommendations.  We  recommend  that  the  Under  Secretary  of  Defense 
for  Acquisition,  Technology,  and  Logistics  coordinate  with  the  Under  Secretary  of 
Defense  (Comptroller)  to  develop  standardized  training  and  update  the  program  policies 
and  procedures  with  internal  controls  addressed  in  this  report.  Also,  we  recommend 
that  the  Director,  Defense  Procurement,  issue  guidance  on  limiting  the  amounts  for 
single  purchases  and  modify  the  purchase  card  contract  to  block  inappropriate 
businesses  from  use  by  cardholders.  We  recommend  the  Director,  DoD  Purchase  Card 
Joint  Program  Management  Office,  review  controls  over  issuing,  using,  and  closing 
purchase  card  accounts.  Also,  we  recommend  that  the  Director  design  and  test  controls 
over  the  use  of  convenience  checks  and  to  verify  the  accuracy  of  data  in  bank  computer 
systems. 


Management  Comments.  The  Director,  Defense  Procurement  generally  concurred 
with  the  audit  findings  and  the  intent  of  all  the  recommendations.  The  Director 
concurred  with  developing  standardized  training  and  updating  program  policies  and 
procedures  with  internal  controls  addressed  in  this  report,  but  non-concurred  with 
modifying  the  purchase  card  contract  regarding  convenience  checks  and  reopening  of 
closed  accounts. 

Audit  Response.  The  corrective  actions  initiated  will  improve  the  controls  for  the 
program.  We  believe  there  are  actions  that  can  be  taken  regarding  convenience  checks 
and  reopening  closed  accounts.  As  a  result,  we  request  that  the  Director,  Defense 
Procurement  comment  on  these  issues  by  April  30,  2002. 
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Background 


Federal  Purchase  Card  Program.  The  first  Government-wide  purchase  card 
contract  was  awarded  by  the  General  Services  Administration  (GSA)  in  1989. 
DoD  entered  the  program  at  that  time.  On  October  13,  1994,  the  President  of 
the  United  States  issued  Executive  Order  12931  mandating  increased  use  of 
purchase  cards  for  micro-purchases  (purchases  under  $2,500).  Micro-purchases 
were  chosen  partly  because  these  types  of  buys  were  generally  less  complex  and 
did  not  require  extensive  procurement  knowledge;  and  goods  were  often 
available  for  immediate  delivery. 

Government- wide  purchases  with  the  purchase  card  grew  from  $1.6  billion  in 
1995  to  more  than  $12  billion  in  2000.  GSA,  the  agency  responsible  for  the 
Government- wide  purchase  card  program,  reports  that  the  Government  saves 
approximately  $1.2  billion  annually  in  administrative  costs  by  using  purchase 
cards.  In  addition,  the  program  earned  the  Government  rebates  in  excess  of 
$50  million  in  FY  2000  by  paying  for  purchases  promptly. 

Federal  Acquisition  Regulation,  part  13,  “Simplified  Acquisition  Procedures,” 
August  7,  2000,  states  that  purchase  cards  should  be  the  preferred  method  for 
purchases  under  $2,500.  Purchase  cards  are  also  preferred  for  making  contract 
payments. 

Purchase  Card  Joint  Program  Management  Office.  The  Deputy  Secretary  of 
Defense  established  the  DoD  Purchase  Card  Joint  Program  Management  Office 
(PMO)  in  March  1998.  The  PMO  is  staffed  with  representatives  from  each  of 
the  Military  Departments,  the  Defense  Logistics  Agency,  and  the  Defense 
Finance  and  Accounting  Service  (DFAS).  The  PMO  reports  directly  to  the 
Director,  Defense  Procurement,  within  the  office  of  the  Under  Secretary  of 
Defense  for  Acquisition,  Technology,  and  Logistics  (USD[AT&L]).  Finance 
and  accounting  issues  are  coordinated  with  the  Under  Secretary  of  Defense 
(Comptroller)  (USD[C]). 

The  Deputy  Secretary  of  Defense  directed  the  PMO  to  promote  purchase  card 
use,  setting  a  goal  that  purchase  cards  be  used  for  90  percent  of  micro-purchases 
by  FY  2000.  The  PMO  reported  that  the  goal  was  met  in  FY  1999,  and 
exceeded  by  5  percent  in  FY  2000.  In  addition,  the  PMO  reported  earning 
rebates,  from  prompt  payment  of  purchases,  amounting  to  $20  million  in 
FY  1999.  USD(AT&L)  directed  the  PMO  to  coordinate  contract  requirements 
with  GSA,  reduce  delinquencies,  deploy  a  standard  DoD-wide  card  management 
and  reconciliation  system,  and  develop  a  DoD-wide  training  program. 

DoD  organizations  are  responsible  for  distributing  cards,  training  employees, 
and  day-to-day  management  of  the  purchase  card  program.  Each  participating 
organization  designates  an  office  to  manage  the  program,  including  assuring 
training  is  provided,  a  current  list  of  cardholders  and  approving  officials  is 
maintained,  and  an  annual  oversight  review  of  the  program  is  performed. 

How  the  DoD  Program  Works.  DoD  selected  Citibank  and  the  U.S.  Bank  to 
process  its  purchase  card  transactions.  The  GSA  contract  requires  Citibank  and 
the  U.S.  Bank  to  develop  guidance  on  duties  and  responsibilities  for  employees 
involved  in  the  Government-wide  purchase  card  program.  Following  those 
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guidelines,  DoD  appointed  agency  program  coordinators1  with  the  responsibility 
for  program  management  at  the  installation,  major  command,  and  Component 
levels.  Coordinators  issue  purchase  cards,  establish  limits  on  spending,  and 
monitor  use  of  a  purchase  card  account. 

Also,  DoD  employees  are  assigned  as  “approving  officials”  to  authorize  and 
approve  purchases  for  payment.  Once  a  cardholder  makes  an  authorized 
purchase,  the  cardholder  and  the  approving  official  reconcile  the  purchased 
goods  and  services  with  the  bank  statement  prior  to  the  approving  official 
requesting  payment  by  DFAS.  See  Appendix  B  for  additional  details  on  the 
organization  of  the  DoD  Purchase  Card  Program. 

Congressional  Interest.  Weaknesses  in  the  DoD  purchase  card  program  came 
to  the  attention  of  both  Congress  and  the  General  Accounting  Office  (GAO) 
during  2001  and  2002.  The  House  of  Representatives  Subcommittee  on 
Government  Efficiency,  Financial  Management,  and  Intergovernmental 
Relations  conducted  hearings  on  July  30,  2001,  and  March  13,  2002.  At  the 
hearings,  Senator  Charles  Grassley  testified  to  the  lack  of  internal  controls  over 
the  DoD  Purchase  Card  Program.  GAO  testified  on  program  abuses  at  two 
Navy  locations  that  were  caused  by  significant  breakdowns  in  purchase  card 
controls.  GAO  specifically  cited  these  breakdowns  as  contributors  to  fraudulent 
and  abusive  spending,  theft,  and  misuse  of  Government  property. 

Other  DoD  Reviews  of  Purchase  Card  Program.  The  Inspector  General  (IG), 
DoD,  and  audit  organizations  in  the  Military  Departments  issued  more  than  300 
reports  on  purchase  cards  between  FYs  1996  and  2001.  IG,  DoD,  Report 
No.  D-2002-029,  “DoD  Purchase  Card  Program  Audit  Coverage,” 

December  27,  2001,  identified  systemic  issues  within  the  purchase  card 
program.  These  systemic  issues  included  account  reconciliation  and 
certification,  administrative  controls,  management  oversight,  property 
accountability,  purchase  card  use,  purchases,  separation  of  duties,  and  training. 

Objective 


The  audit  objective  was  to  evaluate  the  appropriateness  of  the  issuance  and  use 
of  purchase  cards  and  the  controls  over  the  processing  of  purchase  card 
payments.  We  also  reviewed  the  management  control  program  as  it  related  to 
the  overall  objective.  See  Appendix  A  for  a  discussion  of  the  audit  scope  and 
methodology,  the  review  of  the  management  control  program,  and  prior 
coverage. 


'Agency  program  coordinators  are  responsible  for  the  implementation  and  execution  of  the  purchase  card 
program  in  accordance  with  established  DoD  regulations,  policies,  and  procedures. 
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Controls  Over  the  DoD  Purchase 
Card  Program 

The  Purchase  Card  Joint  Program  Management  Office  needed  to 
improve  oversight  and  management  controls  over  231,856  purchase 
cards  and  10.6  million  purchases  in  FY  2001.  Analysis  of  purchase  card 
and  convenience  check  data  for  FYs  2000  and  2001  indicated  that 
improved  controls  were  needed  over: 

•  selecting  cardholders  (29,120  purchase  cards  were  unused  for 
over  6  months), 

•  assigning  approving  officials  (3,463  approving  officials 
oversaw  more  than  7  cardholder  accounts  each  and  3 1  of 
these  approving  officials  oversaw  more  than  100  cardholder 
accounts), 

•  setting  of  spending  limits  (6,533  cardholder  accounts  had  a 
monthly  spending  limit  of  over  $100,000), 

•  transactions  at  blocked  businesses  (over  $4  million  in 
transactions  appeared  to  have  been  made  at  inappropriate 
businesses  that  should  have  been  blocked  by  the  bank), 

•  purchases  declined  by  banks  (687  cardholder  accounts  had  10 
or  more  declined  purchases  in  a  month), 

•  purchases  made  after  card  accounts  were  closed  (transactions 
occurred  on  390  closed  accounts  in  a  month),  and 

•  management  of  convenience  checks  (248  of  12,008  checks 
written  in  a  20-month  period  exceeded  the  $2,500  authorized 
limit). 

These  conditions  did  not  necessarily  mean  that  fraud,  waste,  or 
mismanagement  of  purchase  cards  or  checks  had  occurred.  Some 
conditions  could  be  the  result  of  data  entry  errors,  but  the  absence  of 
internal  controls  increases  the  risk  for  fraud,  waste,  or  mismanagement. 

These  conditions  occurred  because  internal  controls  were  not  sufficient 
or  effective,  policies  and  procedures  for  the  program  were  nonexistent, 
incomplete,  or  not  followed,  and  program  management  and  oversight  did 
not  ensure  that  standardized  training  was  provided  or  that  required 
annual  oversight  reviews  were  conducted. 

As  a  result,  although  the  identified  misuse  was  small  in  comparison  to 
the  volume  of  annual  purchases,  management  controls  were  not  robust 
and  only  through  more  proactive  oversight  can  DoD  ensure  the  integrity 
of  the  program. 


3 


Program  Controls 


Managers  need  to  examine  internal  controls  to  determine  how  well  a  program  is 
performing,  how  it  may  be  improved,  and  the  degree  to  which  controls  help 
identify  and  address  major  risks  for  fraud,  waste,  abuse,  and  mismanagement. 
Office  of  Management  and  Budget  (OMB)  Circular  No.  A-123,  “Management 
Accountability  and  Control,”  June  1995,  states  that  Federal  agencies  have  the 
responsibility  to  ensure  that  resources  are  used  efficiently  and  effectively,  and 
with  minimal  potential  for  fraud,  waste,  and  abuse.  Further,  the  Circular  states 
that  controls  such  as  policies  and  procedures  are  tools  to  help  managers  achieve 
results  and  safeguard  the  integrity  of  programs. 

The  DoD  PMO  needed  to  improve  oversight  and  management  controls  over  the 
purchase  card  program.  We  examined  the  controls  for  issuing  and  using 
231,856  purchase  cards.  We  also  selectively  reviewed  the  controls  over  the 
processing  of  more  than  10.6  million  purchases  amounting  to  $6.1  billion  in 
FY  2001.  In  addition,  we  reviewed  more  than  12,000  convenience  checks 
totaling  more  than  $27  million.  Improved  controls  were  needed  over  the 
following  aspects  of  the  program: 


•  selecting  cardholders  and  assigning  approving  officials, 

•  setting  of  spending  limits, 

•  blocking  and  declining  inappropriate  purchases, 

•  purchases  made  after  card  accounts  were  closed,  and 

•  managing  convenience  checks. 


Selecting  Cardholders  and  Assigning  Approving  Officials 


Controls  over  purchase  cards  were  not  sufficient  to  prevent  organizations  from 
issuing  cards  to  employees  without  a  valid  need.  Organizations  also  did  not 
limit  die  number  of  cardholder  accounts  and  transactions  managed  by  an 
approving  official. 

According  to  the  DoD  Purchase  Card  PMO,  each  DoD  organization  was 
responsible  for  establishing  controls,  such  as  policies  and  procedures,  for 
distributing  purchase  cards.  Also,  each  DoD  organization  was  responsible  for 
selecting  approving  officials2  and  determining  the  number  of  cardholders 
assigned  to  each  approving  official. 

Distribution  of  Cards  Based  on  Need.  According  to  the  PMO,  purchase  cards 
may  be  issued  to  any  individual  that  a  DoD  activity  deems  appropriate.  As  of 
September  30,  2001,  DoD  had  231,856  current  purchase  card  accounts.  The 


2The  U.S.  Bank  uses  the  term  “billing  official”  and  Citibank  uses  “approving  official”  for  an  individual 
responsible  for  ensuring  buys  with  a  purchase  card  are  authorized,  documented,  and  certified  for 
payment.  For  consistency,  we  will  use  the  term  “approving  official”  in  this  report. 
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audit  determined,  however,  that  29,120  purchase  cards  were  not  used  within  a 
6-month  period.  This  lack  of  usage  indicated  the  cards  probably  were  not 
needed  by  the  cardholders. 

Better  controls  were  needed  to  ensure  that  purchase  cards  were  issued  only  to 
employees  with  a  valid  need  to  make  purchases.  In  addition,  controls  should  be 
in  place  to  monitor  the  use  of  cards  and  to  rescind  unused  cards.  Without 
guidance  requiring  an  employee  to  demonstrate  the  need  for  a  card  or 
withdrawal  of  cards  unused  for  a  specific  period,  the  risk  increases  for  card 
misuse. 

Number  of  Cardholders  Managed  by  Approving  Officials.  Some  approving 
officials  managed  more  than  100  cardholder  accounts.  Approving  officials  are  a 
key  control  in  the  purchase  card  process  because  these  officials  verify  the  need 
for  purchases  and  review  the  accuracy  of  monthly  bills.  Table  1  displays  the 
number  of  cardholder  accounts  per  approving  official  within  DoD. 


Table  1.  Number  of  Cardholder  Accounts  per  Approving  Official 

(as  of  May  31,  2001) 

Number  of  Cardholder 
Accounts  per  Approving 
Official 

Number  of  Approving  Officials 

Army 

Navy 

Air  Force 

Defense 

Organizations 

Total 

1  to  7 

18,893 

14,907 

2,584 

43,347 

8  to  20 

1,508 

283 

950 

102 

2,843 

21  to  99 

287 

41 

240 

21 

589 

100  or  more 

21 

3 

4 

3 

31 

Total 

16,101 

2,710 

46,810 

On  July  5,  2001,  the  PMO  issued  policy  guidance  stating  that  approving 
officials  should  normally  be  responsible  for  five  to  seven  cardholders.  Although 
only  7.4  percent  of  the  approving  officials  managed  more  than  7  cardholder 
accounts  (3,463  of  46,810  approving  officials),  31  approving  officials  managed 
more  than  100  cardholder  accounts  each.  (Appendix  C  lists  DoD  organizations 
with  approving  officials  responsible  for  more  than  100  cardholder  accounts.) 
Although  the  31  approving  officials  may  satisfactorily  review  and  process  bills 
for  100  cardholder  accounts  each,  a  large  number  of  transactions  on  the  bills 
may  hinder  a  complete  review. 

Purchase  Transactions  Processed  by  Approving  Officials.  These  31 
approving  officials  processed  more  than  22,150  transactions  in  May  2001. 
However,  the  number  of  transactions  managed  by  each  approving  official  varied 
significantly.  For  example,  an  approving  official  at  the  U.S.  Air  Force 
Education  and  Training  Command  was  responsible  for  105  cardholder  accounts 
that  collectively  had  only  2  purchases  totaling  $28,067  in  May  2001.  However, 
an  approving  official  at  the  Army  Corps  of  Engineers  was  responsible  for 
489  accounts  that  had  3,606  transactions  totaling  $1,490,338  in  May  2001. 


5 


We  selected  two  approving  officials  with  more  than  100  cardholder  accounts 
(one  at  the  Naval  Surface  Warfare  Center  in  Indian  Head,  Maryland,  and 
another  at  the  Walter  Reed  Army  Medical  Research  Acquisition  Activity, 

Forest  Glen,  Maryland)  to  assess  how  effectively  approving  officials  reviewed 
transactions . 

Naval  Surface  Warfare  Center.  At  the  Naval  Surface  Warfare  Center, 
an  agency  program  coordinator  also  performed  the  duties  of  an  approving 
official.  This  approving  official  certified  all  bills  but  only  reviewed  about 
30  percent  of  the  bills  each  month  (the  official  was  responsible  for 
144  cardholder  accounts  in  May  2001  and  170  accounts  in  October  2001). 

For  May  2001,  the  approving  official  certified  1,926  transactions  for 
$1.3  million.  We  were  told  that  the  official  was  certifying  more  than 
100  accounts  because  past  experience  showed  that  using  multiple  approving 
officials  created  delinquencies  and  reduced  rebates.  However,  because  the 
official  was  certifying  unreviewed  bills,  the  risk  of  inappropriate  purchases 
increased. 

Walter  Reed  Army  Medical  Research  Acquisition  Activity.  The 

approving  official  at  Walter  Reed  was  responsible  for  102  cardholder  accounts 
that  processed  1,720  transactions  totaling  $706,196  for  May  2001 .  However, 
the  approving  official  was  not  certifying  all  transactions.  Thus,  inappropriate  or 
unsupported  purchases  were  more  likely  to  occur. 

Impact  of  Account  Reviews  on  Prompt  Payment  of  Bills.  Approving  officials 
responsible  for  a  large  number  of  cardholder  accounts  and  transactions  were 
more  likely  to  have  insufficient  time  to  process  the  bills  for  payment  and  to  have 
bills  become  delinquent.  As  presented  in  Table  2,  approving  officials  with 
seven  or  more  accounts  were  delinquent  in  making  $10.6  million  in  payments. 


Table  2.  Approving  Officials  Managing  7  or  More  Cardholder  Accounts 
(Accounts  With  Delinquencies  as  of  May  31,  2001) 

Number  of  Days  Del 

linquent 

DoD 

Organization 

Number  of 
Approving 
Officials 

1  to  30 

31  to  60 

61  to  90 

91  to  120 

Total 

Army 

64 

$2,017,157 

$1,475,505 

$79,511 

$4,332 

$3,576,505 

Navy 

51 

6,124,829 

652,976 

31,908 

2,421 

6,812,134 

Air  Force 

8 

167,128 

25,352 

599 

854 

193,933 

Other  Defense 
Organizations 

1 

0 

79 

0 

0 

79 

Total 

124 

$8,309,114 

$2,153,912 

$112,018 

$7,607 

$10,582,651 

There  were  no  accounts  more  than  120  days  delinquent  for  these  approving  officials. 

The  124  approving  officials  shown  in  Table  2  represent  only  3.6  percent  of  the 
total  number  of  approving  officials  responsible  for  more  than  7  cardholder 
accounts  and  only  .3  percent  of  all  approving  officials  in  DoD.  However,  these 
124  approving  officials  were  responsible  for  $10.6  million  (29  percent)  of  the 
total  $36.9  million  of  delinquent  transactions  as  of  May  31,  2001.  If  approving 
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officials  are  responsible  for  reviewing  too  many  transactions,  the  risk  increases 
for  delinquent  payments. 


Management  Controls  Needed.  The  Director,  Defense  Procurement,  needs  to 
require  DoD  organizations  participating  in  the  purchase  card  program  to  require 
employees  to  demonstrate  the  need  for  a  purchase  card.  The  PMO  needs  to 
direct  agency  program  coordinators  to  review  card  use  at  least  quarterly  and 
cancel  unneeded  cards.  The  PMO  also  needs  to  ensure  increased  oversight  over 
approving  officials  managing  more  than  seven  cardholder  accounts  or  comply 
with  the  seven  cardholder  account  limit. 

Approving  Officials.  DoD  organizations  use  guidance  developed  by  Citibank 
and  the  U.S.  Bank  to  assign  purchase  card  duties  to  their  employees.  Following 
these  guidelines,  organizations  also  assign  employees  as  approving  officials  to 
supervise  cardholders.  Each  cardholder  should  have  an  approving  official. 
Duties  should  be  separated  between  cardholders  and  approving  officials. 

Assignment  of  Approving  Officials.  We  identified  abnormalities  involving  the 
assignment  of  approving  officials  such  as: 

•  approving  officials  without  cardholders, 

•  cardholders  without  an  approving  official,  and 

•  cardholders  with  more  than  one  approving  official . 

These  abnormal  occurrences  are  shown  in  Table  3  by  DoD  organization. 


Table  3.  Status  of  Approving  Officials 
(as  recorded  in  Citibank  and  U.S.  Bank  systems  as  of  May  31,  2001) 

Number  of  Approving  Officials 

Status  of  Approving 
Officials 

Army 

Navy 

Air  Force 

Other  Defense 
Organizations 

Total 

Approving  Officials 
without  Cardholders 

2,019 

373 

1,234 

412 

4,038 

Cardholders  without  an 
Approving  Official 

422 

1,146 

188 

126 

1,882 

More  Than  One 
Approving  Official 

8 

-0- 

6 

31 

45 

These  abnormalities  could  represent  data  errors  or  outdated  information  in  the 
bank  systems.  Controls  would  have  identified  these  occurrences  for  further 
investigation  and  possible  corrective  action. 

Separation  of  Duties  Between  Cardholders  and  Approving  Officials. 

According  to  OMB  Circular  No.  A-123,  key  duties  of  processing,  reviewing, 
and  authorizing  transactions  for  payment  should  be  separated  among  individuals. 
In  addition,  the  Circular  states  that  managers  should  ensure  that  individuals  do 
not  exceed  or  abuse  assigned  duties. 

Cardholder  and  Approving  Official  Responsibilities.  The  Treasury 
Financial  Manual,  October  5,  2000,  holds  cardholders  responsible  for 
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complying  with  DoD  regulations  and  practices  when  making  purchases. 
Approving  officials  are  responsible  for  ensuring  buys  with  a  purchase  card  are 
authorized,  documented,  and  certified  for  payment. 

Controls  Over  Reviewing  and  Approving  Purchases.  In  May  2001, 
DoD  had  46,810  approving  officials  for  purchase  cards.  These  approving 
officials  represent  the  internal  control  to  prevent  inappropriate  use  of  the 
purchase  cards.  Approving  officials  provide  this  control  by  independently 
reviewing  and  approving  purchases  made  by  the  cardholders.  However,  this 
control  did  not  exist  for  156  accounts  during  May  2001.  Cardholders  were 
inappropriately  performing  the  duties  of  reviewing  and  approving  their  own 
purchases.  Table  4  identifies  the  number  of  card  accounts  where  cardholder  and 
approving  official  duties  were  not  appropriately  separated. 


Table  4.  Number  of  Cardholders  Allowed  to  Review  and 
Approve  Purchases  for  Payment 
(for  May  2001)1 

Activity 

Number  of  Accounts 

Army 

62 

Navy 

37 

Air  Force 

48 

Other  Defense  Organizations 

9 

Total 

156 

Appendix  D  provides  details  on  the  specific  organizations  that  allowed 
cardholders  to  make  purchases  and  certify  those  purchases  for  payment. 

Reviews  on  Duty  Separation  at  Selected  Organizations.  We  selected 
five  DoD  organizations  where  cardholders  were  also  approving  officials  to 
determine  why  duties  were  not  separated.  We  determined  that  the  duties  were 
not  separated  because  neither  the  DoD  activity  managers  nor  the  PMO  had 
verified  that  an  employee  was  not  a  cardholder  before  appointing  the  employee 
as  an  approving  official. 

Reviews  at  two  of  the  five  DoD  organizations  showed  that  inappropriate  actions 
had  occurred.  For  example,  at  one  activity: 

•  unauthorized  personnel  had  certified  purchases  for  7  months, 

•  original  signatures  could  not  be  verified  for  2  of  the  7  months, 

•  two  purchases  were  made  separately  to  avoid  contracting  rules, 

•  no  documents  were  on  file  that  requested  purchases,  and 

•  no  documents  were  on  file  to  support  purchases  made  for  service  or 
maintenance  contracts. 

At  the  second  activity,  no  documents  were  on  file  to  support  purchases  of  a 
Christmas  tree  and  office  furniture.  At  the  other  three  DoD  organizations,  no 
inappropriate  actions  or  purchases  were  found. 
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DoD  auditors  have  issued  22  reports  citing  instances  of  insufficient  separation  of 
duties  involving  purchase  cards.  Further  information  on  these  reports  is 
available  in  KF  DoD,  Report  No.  D-2002-029,  “DoD  Purchase  Card  Program 
Audit  Coverage,”  December  27,  2001. 

Management  Controls  Needed.  The  PMO  should  conduct  regular  analyses  to 
identify  abnormal  conditions  such  as  approving  officials  without  cardholders, 
more  than  one  approving  official  for  a  cardholder,  and  the  existence  of 
cardholders  without  an  approving  official. 

The  PMO  should  require  agency  program  coordinators  to  research  and  resolve 
such  abnormal  occurrences.  The  PMO  also  needs  to  periodically  identify, 
research,  and  correct  inappropriate  separations  of  duty  to  ensure  cardholders  are 
not  allowed  to  be  approving  officials. 

Spending  Limits 


The  Government  purchase  card  can  be  used  as  a  “stand  alone”  simplified 
acquisition  method  in  accordance  with  the  specific  single  purchase  limits  cited  in 
Table  5.  In  addition,  the  card  can  be  used  as  a  payment  method  for  supplies  and 
services  above  the  micro-purchase  threshold  by  warranted  contracting  officers 
and  nonprocurement  cardholders  that  have  been  appropriately  designated  and 
received  specialized  training. 

Authority  for  nonprocurement  cardholders  to  use  the  card  above  the  micro¬ 
purchase  threshold  is  in  the  Federal  Acquisition  Regulation  13.301, 
“Government-wide  Commercial  Purchase  Card.”  This  section  authorizes  use  of 
the  purchase  card  as  a  means  of  placing  a  task  order  or  delivery  order  against  a 
contract,  basic  ordering  agreement,  or  blanket  purchase  agreement.  Thus, 
appropriately  designated  cardholders  may  use  the  card  to  place  orders  for 
supplies  and  services  covered  by  Indefinite  Delivery  Indefinite  Quantity 
contracts,  Federal  Supply  Schedule  contracts,  blanket  purchase  agreements,  and 
other  ordering  instruments. 


Table  5.  Limits  for  Specific  Categories  of  Purchases1 

Categories  of  Purchases 

Limit  of  Purchase 

Supplies  or  services 

$  2,500 

Construction 

2,000 

Training  requests 

25,000 

Medical  services 

2,500 

Nonappropriated  funds 

2,500 

Military  interdepartmental  purchases 

2,500 

Overseas  purchases 

25,000 

1  The  FY  2002  Defense  Authorization  Act,  which  expires  September  30,  2003,  raised 

the  limit  to  $15,000  per  transaction  for  purchases  relating  to  biological  or  chemical 

terrorism,  and  other  terrorist  acts  (76  Federal  Contracts  Report  624). 

According  to  the  PMO,  each  cardholder  has  a  single  purchase  dollar  limit  as 
well  as  a  monthly  purchase  dollar  limit.  The  agency  program  coordinator  along 
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with  the  approving  official  and  resource  manager  determine  the  appropriate 
spending  limit  authorization  controls.  These  authorization  controls  are  imposed 
to  control  spending  and  to  support  a  system  of  funds  controls  in  accordance  with 
available  funding. 

Micro-Purchase  Threshold.  DoD  organizations  issued  purchase  cards  with 
limits  exceeding  $2,500  for  a  single  micro-purchase.  Table  6  shows  that  for  the 
months  of  February  and  May  2001, 3  DoD  cardholders  made  31,018  (14,389 
plus  16,629)  transactions,  valued  at  $311.9  million,  that  exceeded  the 
micro-purchase  threshold. 


Table  6.  Transactions  Over  the  Micro-Purchases  Threshold 
(during  February  and  May  2001) 

Organizations 

Number  of 
Transactions  in 
February  2001 
over  $2,500 

Amount  of 
Transactions 

Number  of 
Transactions 
in  May  2001 
over  $2,500 

Amount  of 
Transactions 

Army 

4.767 

$61,496,513 

5,462 

$60,312,011 

Navy 

4,300 

43.123,109 

4,848 

48,309,526 

Air  Force 

3,660 

25.861,464 

4,383 

31,248,021 

Other  Defense 
Organizations 

1,662 

19,772,481 

1,936 

21,835,509 

Total 

14,389 

$150,253,567 

16,629 

$161,705,067 

The  micro-purchase  threshold  was  exceeded  by  amounts  ranging  from  $.70  to 
$206,326  during  May  2001.  Although  the  cardholders  that  exceeded  the 
micro-purchase  threshold  may  have  used  the  card  appropriately  in  each  of  these 
transactions  as  a  payment  method,  we  were  not  able  to  validate  this  premise 
from  the  available  data.  The  PMO  advised  that  there  was  no  way  to  segregate 
bank  reported  purchase  card  transactions  and  associated  dollars  data  to  indicate 
whether  the  card  was  used  as  a  method  of  acquisition  or  as  a  method  of 
payment.  The  data  show  the  need  for  increased  controls  by  approving  officials 
for  reviewing  and  certifying  transactions  for  payment. 

Comparison  of  Spending  Limits  to  Available  Funds.  Table  7  shows  the 
amount  cardholders  and  approving  officials  were  authorized  to  spend  in  a  given 
billing  cycle  as  indicated  in  information  provided  by  the  banks.  For  cardholder 
accounts,  this  amount  defines  the  maximum  amount  that  may  be  charged  in  one 
monthly  billing  cycle.  For  approving  officials,  this  amount  is  a  multiple  of 
three  of  the  cycle  dollar  limit. 


3Purchase  card  data  was  obtained  for  the  months  of  February  and  May  2001  unless  otherwise  noted  in 
this  report. 
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Table  7.  Cardholder  and  Approving  Official 

Monthly  Spending  Limits 
(in  billions  of  dollars) 

DoD 

Organization 

Cardholders’ 

Limits 

Approving  Officials’ 
Limits 

Army 

$3.0 

$7.5 

Navy 

1.5 

35.4 

Air  Force 

1.8 

4.5 

Other  Defense 
Organizations 

.8 

1.6 

Total 

$7.1 

$49.0 

The  FY  2002  DoD  Appropriations  Act  provided  DoD  with  $332.6  billion. 
Approving  officials  had  annualized  spending  limits  of  $196.4  billion 
($49.0  billion  divided  by  3  multiplied  by  12),  or  59  percent  of  the  DoD  budget. 

During  May  2001,  6,533  cardholder  accounts  had  monthly  limits  exceeding 
$100,000  and  40  of  those  accounts  had  a  limit  of  $9,999,999.  Cardholders 
could  spend  up  to  $9,999,999  for  a  single  purchase  or  per  month  if  no 
approving  official  limit  was  entered  into  the  bank  system. 

High  spending  limits  created  the  potential  for  inappropriate  purchases  and  could 
lead  to  potential  violations  of  the  Antideficiency  Act  if  spending  exceeded 
budgeted  funds.  For  example,  a  U.S.  Bank  report  showed  that  cardholders  of 
the  Air  Force  1st  Fighter  Wing  had  a  yearly  spending  limit  of  $6.6  billion. 
However,  the  1st  Fighter  Wing  had  an  annual  budget  of  only  $130  million. 
Therefore,  the  cardholder  spending  limit  was  potentially  50  times  greater  than 
the  budget  of  available  funds  for  the  entire  Wing.  The  PMO  and  U.S.  Bank 
contend  that  the  report  was  inaccurate;  however,  neither  organization  was  able 
to  document  this  assertion  or  demonstrate  that  corrective  actions  were  completed 
to  adjust  the  credit  limits. 

Accuracy  of  Limits  Recorded  in  Bank  Systems.  Reports  generated  by  the 
U.S.  Bank  computer  system  were  not  accurate  in  that  they  failed  to  show  actual 
amounts  established  in  the  system  by  DoD  personnel. 

Establishing  Purchase  Card  Accounts.  Within  the  purchase  card 
program,  the  agency  program  coordinator  was  responsible  for  establishing  new 
purchase  card  accounts  in  the  bank  systems.  When  establishing  an  account,  the 
agency  program  coordinator  was  responsible  for  establishing  controls  over 
spending  by  entering  a  limit  on  the  amount  to  be  spent  for  a  single 
micro-purchase  and  over  the  period  of  a  month.  In  addition,  the  agency 
program  coordinator  was  responsible  for  maintaining  these  spending  controls  by 
changing  the  single  micro-purchase  and  monthly  limits  in  the  bank  system  when 
needed. 


Changing  Purchase  Card  Accounts.  At  the  U.S.  Bank,  changes  made 
to  single  micro-purchase  and  monthly  spending  limits  did  not  properly  update 
the  bank’s  system.  For  example,  the  Air  Force  1st  Fighter  Wing  personnel 
entered  changes  into  the  bank  system  for  20  accounts.  The  changes  should  have 
restricted  the  total  monthly  spending  limit  for  the  20  accounts  to  $427,100. 
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However,  the  changes  did  not  appropriately  update  in  the  system.  In  addition, 
the  bank  system  showed  that  512  card  accounts  in  the  1st  Fighter  Wing  had  no 
limit  on  single  micro-purchases. 

The  1st  Fighter  Wing’s  headquarters,  the  Air  Combat  Command,  and  bank 
personnel  stated  that  the  problem  was  identified  during  testing  of  the  U.S.  Bank 
system  in  December  2000.  However,  the  PMO  and  users  of  the  bank  system 
were  not  aware  of  the  problem  as  of  June  2001 .  Furthermore,  as  of  November 
2001,  the  problem  was  still  uncorrected. 

Management  Controls  Needed.  To  improve  controls  over  spending  limits,  the 
Director,  Defense  Procurement,  should  develop  written  guidance  for  issuing 
purchase  cards  that  includes  a  methodology  for  use  by  agency  program 
coordinators  in  establishing  spending  limits  for  cardholders  and  approving 
officials.  In  addition,  proper  oversight  by  the  PMO  must  be  in  place  to  ensure 
cardholders  are  adhering  to  the  limits.  Proper  oversight  by  the  PMO  should 
include  requiring  agency  program  coordinators  to: 

•  perform  periodic  reviews  on  the  amount  of  purchases  made  by 
cardholders, 

•  adjust  the  purchase  limit  to  the  minimum  amount  justified  by  use, 
and 

•  ensure  purchase  limits  are  established. 

In  addition,  the  PMO  should  follow  up  to  ensure  that  appropriate  reviews  are 
made  by  the  agency  program  coordinators  and  that  purchase  limits  recorded  by 
U.S.  Bank  and  Citibank  are  those  requested  by  DoD.  Commercial  credit  card 
companies  reduce  the  risk  of  bad  debts  by  setting  a  dollar  limit  on  purchases 
allowed  by  customers.  Accordingly,  the  PMO  must  ensure  that  limits  are  in 
place  and  that  DoD  employees  are  limited  to  the  minimum  amount  of  purchases 
based  on  funds  available  and  the  justifiable  needs  of  an  activity. 

Blocked  Businesses 


The  GSA  contract  instructs  Citibank  and  the  U.S.  Bank  to  prevent  inappropriate 
use  of  purchase  cards  by  blocking  purchases  from  some  businesses.  However, 
purchase  cards  were  sometimes  used  to  process  inappropriate  transactions. 

Use  of  Cards  at  Blocked  Businesses.  The  PMO  provided  information  on  its 
Internet  website  that  prohibited  cardholders  from  making  purchases  from 
businesses  such  as  jewelry  stores,  pawn  shops,  and  dating  or  escort  services. 
The  banks  were  supposed  to  block  transactions  from  these  businesses. 

However,  the  banks  processed  more  than  $4  million  in  transactions  from 
businesses  supposedly  blocked.  Table  8  shows  the  transactions  not  blocked  by 
banks  between  October  1999  and  May  2001. 


12 


Table  8.  Transactions  Not  Blocked  by  Banks 
(between  October  1999  and  May  2001) 

Businesses  Coded  as 

Number  of 
Transactions 

Amount  of 
Transactions 

Jewelry  Stores 

3,034 

$1,630,052 

Direct  Marketing  Insurance 

1,636 

1,390,188 

Pawn  Shops 

634 

291,282 

Antique  Shops 

550 

254,578 

Financial  Institutions  -  Manual  Cash  Advance 

68 

320,766 

Dating  and  Escort  Services 

61 

5,528 

Antique  Reproductions 

53 

33,809 

Security  Brokers  or  Dealers 

52 

32,974 

Timeshares 

47 

34,070 

Court  Costs,  Alimony,  and  Child  Support 

36 

7,203 

Bail  and  Bond  Payments 

4 

12,673 

Political  Organizations 

3 

900 

Fines 

3 

1,482 

Wire  Transfer— Money  Orders 

2 

644 

Betting,  Casino  Chips,  and  Off-Track  Betting 

2 

2,508 

Total  Number  and  Amount  of  Transactions 

6,185 

$4,018,657 

Verifying  the  Appropriateness  of  Selected  Transactions.  We  selected 
229  questionable  transactions  made  between  October  1999  and  July  2001  to 
determine  whether  the  transactions  were  made  for  valid  purposes.  By 
contacting  vendors  and  conducting  internet  searches,  we  determined  that  157  of 
the  229  transactions  were  appropriate;  however,  the  business’  bank  had 
miscoded  the  business.  For  example,  65  of  the  transactions  were  coded  as  7273 
(Dating  and  Escort  Services);  however,  the  majority  of  these  transactions  were 
to  various  computer  companies,  which  should  have  been  coded  as  7372 
(Computer  Programming,  Integrated  Systems  Design,  and  Data  Processing 
Services) . 

A  more  detailed  review  of  95  of  the  229  transactions  through  on-site  auditor 
verification  of  cardholder  billing  statements  and  supporting  documentation,  to 
include  cardholder  interviews,  was  also  conducted.  This  review  showed  that  94 
of  the  95  transactions  were  made  for  appropriate  purposes,  although  the  code 
numbers  used  by  the  bank  were  incorrect  for  79  of  the  95  transactions.  The  one 
inappropriate  transaction  was  referred  to  the  Defense  Criminal  Investigative 
Service  for  further  investigation. 

Management  Controls  Needed.  The  Director,  Defense  Procurement,  needs  to 
publish  a  list  of  the  specific  types  of  businesses  blocked  from  use  by 
cardholders.  Also,  the  Director  needs  to  request  that  GSA  modify  the  purchase 
card  contract  to  require  banks  to  block  purchases  from  businesses  considered 
inappropriate  by  DoD  organizations  participating  in  the  purchase  card  program. 

Purchases  Declined  by  Banks 


The  banks  appropriately  denied  some  attempted  purchases.  According  to  bank 
records,  these  attempted  purchases  were  declined  because  cardholders  did  not 
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have  enough  available  credit,  the  bank  system  was  not  operating,  the  account 
was  temporarily  closed,  or  the  account  needed  to  be  activated. 

Cardholders  made  954,002  purchases  amounting  to  more  than  $488.2  million 
during  February  2001.  However,  11,480  cardholder  accounts  were  declined 
44,893  purchases.  Cardholders  attempting  to  make  purchases  despite  repeated 
denials  could  suggest  attempts  to  use  the  cards  inappropriately.  Although  over 
90  percent  of  the  cardholder  accounts  with  declined  purchases  had  fewer  than 
10  attempts  to  process  purchases  during  February  2001,  as  shown  in  Table  9, 
some  cardholders  had  a  significant  number  of  purchases  declined.  One 
cardholder  with  the  U.S.  Army  Contracting  Command  in  Korea  had  a  total  of 
78  declined  purchases.  This  cardholder  attempted  purchases  at  home  furnishing 
stores,  equipment  rental  stores,  fuel  dealers,  and  drapery  and  upholstery  stores. 


Table  9.  Number  of  Card  Accounts  with  Declined  Purchases 
(as  of  February  2001) 

Organizations 

10  or  Fewer 
Purchase 
Attempts 
Declined 

1 1  or  More 
Purchase 
Attempts 
Declined 

Total  Number  of 
Card  Accounts  with 
Declined  Purchases 

Army 

4,413 

235 

4,648 

Navy 

1.936 

250 

2,186 

Air  Force 

3.746 

150 

3,896 

DoD  Organizations 

698 

52 

750 

Total 

10,793 

687 

11,480 

Management  Controls  Needed.  The  PMO  needs  to  direct  agency  program 
coordinators  to  identify  and  investigate  accounts  when  cardholders  are 
attempting  to  make  purchases  after  repeated  declines  by  the  banks. 

Purchases  Made  After  Card  Accounts  Were  Closed 


Purchases  were  processed  for  some  card  accounts  after  the  accounts  were 
closed.  According  to  the  banks,  the  accounts  had  been  closed,  but  not 
terminated.  Because  the  accounts  were  only  closed,  the  banks  allowed  the 
accounts  to  be  reopened  for  processing  purchases.  Many  transactions  were  for 
America  OnLine  internet  accounts.  Table  10  details  the  number  of  transactions 
processed  on  closed  accounts. 
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Table  10.  Transactions  on  Closed  Accounts 
(May  2001) 

Organizations 

Number  of 
Cardholder 
Accounts 

Number  of 
Transactions 

Dollar  Value 

Army 

147 

251 

$171,734 

Navy 

82 

115 

42,758 

Air  Force 

128 

210 

184,785 

Other  Defense 
Organizations 

33 

48 

40,443 

Total 

390 

624 

$439,720 

Although  the  number  of  purchases  processed  through  closed  accounts  was  small, 
some  purchase  card  agency  program  coordinators  believed  that  no  transactions 
could  be  processed  through  these  accounts  once  closed.  Because  some 
approving  officials  and  agency  program  coordinators  were  not  aware  that  the 
banks  would  process  transactions  through  these  closed  accounts,  the  risk 
increased  for  undetected  fraudulent  transactions. 

Controls  were  not  always  in  place  and  working  to  detect  fraudulent  transactions. 
For  example,  the  Army  Materiel  Command  cardholders  were  only  required  to 
sign  a  list  as  proof  that  an  old  purchase  card  was  returned.  The  activity  did  not 
attempt  to  determine  whether  the  card  account  had  unrecorded  purchases, 
unreceived  purchases,  or  automatically  recurring  purchases  (such  as 
subscriptions).  Therefore,  purchases  could  be  processed  on  closed  accounts 
without  detection  by  the  purchase  card  approving  officials  and  agency  program 
coordinators. 

Management  Controls  Needed.  The  PMO  needs  to  coordinate  with  the  banks 
and  modify  the  purchase  card  contract  to  include  procedures  that  prevent  card 
accounts  from  being  reopened  after  closure. 

Convenience  Checks 


According  to  the  DoD  Financial  Management  Regulation,  the  desired  method 
for  making  all  payments  within  the  United  States  is  transferring  funds 
electronically.  When  electronic  transfers  of  funds  are  not  practical,  the 
Financial  Management  Regulation  permits  the  use  of  purchase  cards.  If  a 
business  refuses  to  accept  the  purchase  card  or  if  use  of  the  card  is  impractical, 
DoD  may  use  a  convenience  check.4 

Within  the  purchase  card  program,  the  GSA  contract  requires  the  U.S.  Bank 
and  Citibank  to  accommodate  DoD  organizations  with  convenience  checks. 
Convenience  checks  provide  an  alternative  for  DoD  to  make  minor  purchases 
when  cash,  purchase  cards,  and  other  alternatives  are  not  usable.  Convenience 
checks  should  not  exceed  $2,500  ($10,000  in  support  of  a  contingency  if 


4  Convenience  checks  are  a  contractor-provided  product  and  service  that  allows  checks  to  be  written  on  a 
card  account  within  established  dollar  limits. 
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overseas).  Use  of  convenience  checks  was  not  properly  monitored  to  ensure 
that: 


•  checks  did  not  exceed  $2,500, 

•  checks  were  not  used  to  make  purchases  when  the  purchase  card 
could  have  been  used,  and 

•  checks  were  not  used  to  buy  unauthorized  items. 

Use  of  Convenience  Checks.  Convenience  checks  amounting  to  more 
than  $1.9  million  were  written  for  amounts  greater  than  the  authorized  $2,500. 
Although  approving  officials  were  responsible  for  certifying  payments  of  bills, 
almost  250  convenience  checks  were  written  in  excess  of  $2,500  by  DoD 
organizations,5  as  shown  in  Table  11. 


Table  11.  Convenience  Checks  Written 
for  Amounts  Exceeding  $2,500 
(between  October  1999  and  May  31,  2001) 

Organizations 

Total  Number  of 
Checks  Written 

Number  of 
Checks  Over 
$2,500 

Value  of 
Checks  Over 
$2,500 

Army 

6,478 

35 

$  209,834 

Navy 

2,241 

135 

1,225,513 

Air  Force 

2,352 

60 

337,148 

Other  Defense 
Organizations 

932 

18 

128,036 

Unknown 

5 

-0- 

-0- 

Totals 

12,008 

248 

$1,900,531 

Although  the  percentage  of  checks  written  for  amounts  greater  than  $2,500  was 
not  significant  when  compared  with  the  total  number  of  checks  written,  the  DoD 
Financial  Management  Regulation  prohibits  writing  checks  for  more  than 
$2,500. 

Reviews  on  Convenience  Checks.  The  PMO  conducted  quarterly 
reviews  on  convenience  checks  issued  for  amounts  greater  than  $2,500  and  sent 
the  results  semiannually  to  each  of  the  Services  and  other  Defense  organizations. 
Also,  the  PMO  required  all  organizations  to  conduct  an  audit  and  to  cancel 
checking  accounts  that  violated  the  DoD  Financial  Management  Regulation 
limitation  of  $2,500  per  check. 

The  PMO  reviewed  convenience  checks  issued  from  July  1,  2000,  through 
December  31,  2000.  The  review  identified  38  convenience  checks  issued  for 
more  than  $2,500.  The  PMO  determined  the  primary  reasons  for  checks  issued 
for  more  than  $2,500  as: 

•  approving  officials  did  not  properly  oversee  check  writing, 


5A  total  of  $27,389,557  of  convenience  checks  were  written  between  October  1999  and  May  31,  2001. 


16 


•  check  writers  avoided  the  splitting  of  a  purchase  (splitting  of 
purchases  is  prohibited  by  the  Federal  Acquisition  Regulation),  and 

•  check  writers  were  not  familiar  with  guidance  for  using  the  checks. 

The  PMO  performed  its  initial  review  of  convenience  checks  for  the  period  of 
January  1,  2000,  through  June  30,  2000.  The  initial  review  determined  that  the 
Army,  Navy,  and  Air  Force  had  issued  80  convenience  checks  for  more  than 
$2,500  totaling  $464,683.  Similar  to  the  most  recent  review— July  1 ,  2000, 
through  December  3 1 ,  2000— the  organizations  contended  that  most  of  the 
checks  were  issued  for  more  than  $2,500  because  check  writers  and  approving 
officials  were  not  aware  of  the  guidance  relating  to  convenience  checks.  As  of 
November  21,  2001,  the  PMO  had  received  results  of  the  reviews  from  all 
organizations  except  the  Defense  Intelligence  Agency. 

Use  of  Convenience  Checks  at  Businesses  That  Accept  the  Purchase 
Card.  Convenience  checks  were  inappropriately  used  at  businesses  that 
accepted  the  purchase  card.  According  to  the  DoD  Financial  Management 
Regulation,  convenience  checks  are  an  alternative  to  cash  for  paying  official 
expenses  of  DoD  organizations  that  previously  used  imprest  funds. 

Convenience  checks  should  be  used  only  after  purchase  cards  are  determined  to 
be  unusable.  In  addition,  cardholders  can  use  purchase  cards  to  pay  for  training 
costs  up  to  $25,000;  therefore,  convenience  checks  should  not  be  used  for  this 
purpose  unless  purchase  cards  are  unusable  in  which  case  convenience  checks 
can  be  used  to  pay  for  training  costs  up  to  $2,500. 

Table  12  identifies  409  convenience  checks  that  were  written  to  businesses  that 
accepted  purchase  cards.  For  example,  convenience  checks  were 
inappropriately  used  to  make  purchases  at  businesses  such  as  the  U.S.  Postal 
Service,  Federal  Express,  and  the  United  Parcel  Service. 

In  addition,  484  checks  were  written  to  purchase  training.  These  purchases 
represent  potential  opportunities  for  misuse  of  the  card.  The  PMO  needs  to 
periodically  research  checks  written  for  training  to  ensure  that  purchase  cards 
were  determined  unusable. 


6Imprest  funds  were  authorized  to  make  small  purchases  (not  exceeding  $500)  of  supplies  or  services  on 
an  “imprest  basis.”  An  “imprest  basis”  means  that  the  amount  of  the  fund  was  to  remain  constant. 
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Table  12. 

Convenience  Checks  Written  to  Businesses 

That  Accept  Purchase  Cards 
(October  1999  through  May  2001) 

Payee  of  Checks 

Checks  Written  for  more  than  $2,500 

Number  of  Checks 

Business 

18 

409 

Training 

46 

484 

Total 

64 

893 

Further,  28  convenience  checks  written  for  more  than  $2,500  were  written  to 
individuals.  For  example,  at  one  DoD  organization,  checks  were  written  to 
individuals  for  services  at  a  chapel.  During  April  and  May  2001,  checks  for 
$1,300,  $840,  and  $220  were  written  to  a  priest,  a  music  director,  and  an 
organist,  respectively.  While  these  checks  could  represent  valid  payments, 
checks  could  be  fraudulently  written  to  relatives,  friends,  or  other  individuals. 

Management  Controls  Needed.  PMO  needs  to  continue  to  review  purchase 
card  data  at  least  semiannually  to  identify  convenience  checks  written  in 
amounts  greater  than  $2,500  or  for  inappropriate  purposes.  In  addition,  the 
PMO  should  take  the  following  actions: 

•  reemphasize  DoD  guidance  concerning  what  payments  can  and 
cannot  be  made  using  convenience  checks, 

•  require  agency  program  coordinators  to  research  convenience  check 
transactions  and  to  take  appropriate  actions  to  correct  improper  uses 
of  the  checks, 

•  request  the  GSA  to  amend  the  purchase  card  contract  to  state  that 
convenience  checks  not  written  in  accordance  with  the  DoD  Financial 
Management  Regulation  will  not  be  honored, 

•  identify  convenience  checks  written  to  individuals  and  require  agency 
program  coordinators  to  research  the  transactions,  and 

•  follow  up  with  agency  program  coordinators  to  ensure  appropriate 
corrective  actions  are  performed. 

Purchase  Card  Program  Policies,  Procedures,  and  Oversight 


Internal  controls  were  neither  sufficient  nor  effective  because  policies  and 
procedures  for  the  program  were  nonexistent,  incomplete,  or  not  followed;  and 
program  management  and  oversight  did  not  ensure  that  standardized  training 
was  provided  or  that  annual  oversight  reviews  were  conducted. 

Development  and  Use  of  Policies  and  Procedures.  OMB  Circular  No.  A-123 
states  that  controls  such  as  policies  and  procedures  help  managers  achieve 
results  and  safeguard  the  integrity  of  programs.  The  PMO  had  delegated  the 
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development  of  many  policies  and  procedures  for  the  program  to  the  DoD 
organizations.  As  a  result,  policies  and  procedures  either  did  not  exist,  were 
incomplete,  or  were  not  followed. 

Program  Management  and  Oversight.  Management  and  oversight  of  the 
purchase  card  program  needed  improvement.  The  Treasury  Financial  Manual 
requires  DoD  to  develop  internal  procedures  for  using  the  purchase  card.  The 
Manual  stipulates  that  those  procedures  should  include  internal  controls  such  as 
training  program  participants  and  conducting  annual  program  oversight  review. 

Training  Program  Participants.  No  DoD  guidance  lists  the  specific 
training  that  an  employee  should  receive  prior  to  obtaining  a  purchase  card. 
According  to  DoD  Directive  7000.15,  “DoD  Accountable  Officials  and 
Certifying  Officers,”  July  8,  1998,  DoD  organizations  are  required  to  provide 
training  to  new  cardholders,  approving  officials,  and  agency  program 
coordinators.  This  training  includes  initial  training  to  new  cardholders  and 
periodic  refresher  training  to  current  cardholders. 

The  PMO  stated  that  the  agency  program  coordinators  were  responsible  for 
ensuring  that  the  cardholders  and  approving  officials  received  the  proper 
training.  However,  the  PMO  did  not  review  the  agency  program  coordinators’ 
records  to  ensure  that  training  was  provided. 

Program  Oversight  Reviews.  Annual  oversight  reviews  were  not 
performed  consistently.  During  the  audit,  we  visited  six  locations.  Two 
locations,  the  Air  Force  1st  Fighter  Wing  and  the  Army  Materiel  Command, 
conducted  internal  reviews.  However,  the  other  four  locations  did  not. 

Management  Controls  Needed.  The  USD(AT&L)  needs  to  coordinate  with  the 
USD(C)  to  review  DoD  policies  and  procedures  that  address  internal  control 
weaknesses  identified  in  this  report.  Also,  the  USD(AT&L)  should  develop 
guidelines  for  DoD  organizations  to  use  for  issuing  and  using  purchase  cards, 
and  processing  card  purchases  and  convenience  checks. 

In  addition,  the  USD(AT&L)  should  develop  standardized  training  and  add  a 
requirement  in  the  DoD  Financial  Management  Regulation  that  the  training  be 
completed  by  cardholders,  approving  officials,  and  agency  program 
coordinators.  Further,  the  PMO  should  require  all  DoD  organizations  to  submit 
reports  on  the  results  of  oversight  reviews  and  provide  guidance  to  effect 
corrective  actions  as  needed. 

Actions  Taken  by  Management  During  the  Audit 


During  this  audit,  the  PMO  and  the  Director,  Defense  Procurement,  took 
actions  to  strengthen  controls  over  the  purchase  card  program.  For  example, 
the  PMO  issued  guidance  on  July  5,  2001,  to  strengthen  controls  over  the 
supervision  of  cardholders.  The  memorandum,  “Internal  and  Management 
Controls  -  DoD  Purchase  Card  Program,”  states  that  commanders  and  directors 
need  to  limit  the  number  of  cardholders  supervised  by  an  approving  official  to 
seven  cardholders. 
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In  addition,  the  Director,  Defense  Procurement  issued  a  memorandum  on 
August  13,  2001,  requesting  the  Military  Departments  and  Defense  agencies  to: 

•  review  cardholder  bills  to  verify  cardholder  authorizations  to  buy 
items  on  the  bills,  verify  receipt  of  items,  and  record  appropriate 
items  on  property  records; 

•  ensure  cardholders  had  a  continuing  need  to  have  a  purchase  card; 

•  restrict  purchase  limits  to  a  reasonable  amount  based  on  need; 

•  limit  the  number  of  cardholders  per  approving  official;  and 

•  perform  spot  checks  on  internal  controls,  to  include  using  audit 
organizations  and  inspectors  general  to  assist. 

The  Director,  Defense  Procurement,  requested  assistance  from  the  IG,  DoD,  on 
August  14,  2001.  Specifically,  the  Director  requested  assistance  obtaining  audit 
results  on  the  purchase  card  program  to  assist  with  managing  the  program, 
tracking  fraud,  and  identifying  trends  of  misuse. 

Also,  the  PMO  and  the  Director,  Defense  Procurement,  agreed  at  a  meeting 
with  IG,  DoD,  representatives  on  October  3,  2001,  to  take  actions  to  correct 
weaknesses  identified  in  controls  over  restricting  purchases  from  inappropriate 
businesses,  to  include: 

•  advising  Citibank  and  U.S.  Bank  on  the  types  of  businesses  blocked 
from  use  and  requesting  verification  from  the  banks  that  the  codes 
were  blocked; 

•  requesting  DFAS  to  expand  its  participation  in  Operation  Mongoose7 
to  include  data  mining  of  purchase  card  data  using  the  results  of  work 
performed  by  the  IG,  DoD,  and  the  Air  Force  Audit  Agency;  and 

•  distributing  letters  to  all  cardholders  and  approving  officials 
providing  the  codes  of  businesses  blocked  from  use. 

Finally,  the  PMO  issued  a  memorandum  on  October  5,  2001,  “Blocking  of 
Merchant  Category  Codes,”  to  strengthen  controls  over  the  types  of  businesses 
used  by  cardholders.  The  memorandum  advises  cardholders  of  the  need  to 
adhere  to  DoD  policy  that  restricts  purchases  from  certain  businesses. 

In  addition,  the  memorandum  authorizes  agency  program  coordinators  to  restrict 
cardholder  purchases  from  additional  inappropriate  businesses.  The 
memorandum  alerted  cardholders  that  the  Operation  Mongoose  Program  would 
be  expanded  to  detect  both  authorized  purchases  made  at  inappropriate  types  of 
businesses,  and  declined  purchases. 


7  The  Operation  Mongoose  Program  was  started  to  identify  erroneous,  duplicate,  or  fraudulent  payments 
and  to  detect  and  correct  internal  control  weaknesses.  The  program  includes  personnel  from  the 
Defense  Finance  and  Accounting  Service;  the  Defense  Manpower  Data  Center;  and  the  Inspector 
General,  DoD. 
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On  March  12,  2002,  the  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics  and  the  Under  Secretary  of  Defense  (Comptroller) 
issued  a  joint  memorandum  that  emphasized  the  need  for  all  DoD  organizations 
to  maintain  adequate  internal  review  programs.  The  memorandum  also 
emphasized  that  managers  at  all  levels  are  responsible  for  investigating  alleged 
cases  of  purchase  card  fraud  or  abuse,  and  taking  appropriate  corrective  and 
disciplinary  action. 

Conclusion 


Although  numerous  audit  reports  issued  over  the  last  7  years  have  identified  a 
wide  range  of  implementation  problems  in  the  DoD  purchase  card  program,  the 
program  remains  an  important  part  of  the  DoD  acquisition  streamlining  effort. 
This  report  identifies  specific  risk  factors  that  still  existed  in  FY  2001  that 
required  more  proactive  oversight.  Actions  were  taken  during  the  audit  by  the 
senior  DoD  managers  and  the  Director,  DoD  Purchase  Card  Joint  Program 
Management  Office  to  strengthen  controls  over  the  program,  to  include  those 
pertaining  to  the  supervision  of  cardholders,  and  to  restricting  purchases  from 
potentially  inappropriate  businesses.  The  IG,  DoD,  as  well  as  other  elements  of 
the  DoD  audit  and  investigative  oversight  community,  will  continue  to  work 
closely  with  those  managers  to  improve  the  program  and  take  action  against 
individuals  who  misuse  credit  card  privileges. 

Management  Comments  on  the  Finding  and  Audit  Response 


The  Director,  Defense  Procurement,  Office  of  the  Under  Secretary  of  Defense 
for  Acquisition,  Technology  and  Logistics  generally  concurred  with  the  audit 
findings  and  the  intent  of  all  the  recommendations.  For  clarification  purposes,  a 
discussion  on  the  application  of  spending  limits  as  an  authorization  control  and 
the  inconsistency  between  the  bank’s  reporting  system  and  their  authorization 
controls  was  provided. 

Management  Comments  on  Spending  Limits.  The  Director  stated  that  the 
findings  in  the  report  on  spending  limits  may  not  be  accurate  in  all  cases.  The 
findings  may  have  misrepresented  actual  limits  because  the  auditor  did  not 
review  cardholder  and  billing  account  limits  together  and,  the  report  provided 
by  the  bank  showing  spending  limits  was  inaccurate. 

Audit  Response.  The  audit  team  reviewed  data  provided  by  the  bank  on 
cardholder  and  billing  account  limits  together  and  identified  discrepancies 
between  those  data  and  the  limits  requested  by  program  coordinators.  These 
discrepancies  were  brought  to  the  attention  of  the  Program  Management  Office 
and  the  bank.  Although  the  Program  Management  Office  states  that  the  bank 
subsequently  corrected  the  problem,  the  documentation  requested  by  the  audit 
team  to  support  that  assertion  has  not  been  received.  Effective  implementation 
of  corrective  action  in  response  to  recommendation  9  should  address  this 
problem. 
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Recommendations,  Management  Comments  and  Audit 
Response 


We  recommend  that  the  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics: 

1.  Coordinate  with  the  Under  Secretary  of  Defense  (Comptroller)  and 
review  DoD  policies  and  procedures  to  address  internal  control  weaknesses 
identified  in  this  report.  Develop  written  guidelines  for  DoD  organizations 
to  use  for  issuing  and  using  purchase  cards,  and  the  processing  of  purchases 
and  convenience  checks. 

Management  Comments.  The  Director,  Defense  Procurement  concurred  and 
stated  that  in  addition  to  actions  taken  during  the  course  of  the  audit,  the 
Program  Management  Office  is  in  the  process  of  advising  the  Defense 
Components  to  close  purchase  cards  that  are  no  longer  needed  and  to  place 
controls  over  valid  cards  that  are  infrequently  used  to  protect  the  government 
from  potential  cardholder  or  outside  fraudulent  use.  The  Program  Management 
Office  memorandum  will  be  issued  no  later  than  April  5,  2002. 

2.  Develop  standardized  training  for  the  purchase  card  program. 
Coordinate  with  the  Under  Secretary  of  Defense  (Comptroller)  on  updating 
the  DoD  Financial  Management  Regulation  with  the  requirement  for 
purchase  card  training. 

Management  Comments.  The  Director,  Defense  Procurement  concurred  and 
stated  that  the  Program  Management  Office  is  completing  efforts  on  an 
interactive  purchase  card  training  module  for  the  DoD  to  be  on-line  by  mid  July 
2002.  In  addition,  as  a  part  of  a  Comptroller  lead  review  of  the  Travel  Card 
and  Purchase  Card  Programs  in  March  2002,  both  regulatory  guidance  and 
training  adequacy  are  being  assessed.  Final  recommendations  are  forthcoming 
and  are  expected  to  further  address  this  recommendation. 

We  recommend  that  the  Director,  Defense  Procurement: 

3.  Distribute  guidance  for  issuing  purchase  cards  that  includes  a 
methodology  for  use  by  agency  program  coordinators  in  establishing 
spending  limits  for  cardholders  and  approving  officials.  Require  single 
purchase  limits  for  all  cardholders. 

Management  Comments.  The  Director,  Defense  Procurement  concurred  and 
stated  that  a  memorandum  dated  August  13,  2001  advised  the  Defense 
Components  to  set  cardholder  spending  limits  and/or  billing  account  spending 
limits  based  on  cardholder  projected  needs  and  available  funds. 

Audit  response.  The  August  13,  2001  guidance  suggested  components  perform 
frequent  spot  checks  of  the  recommended  internal  controls.  The  occurrence  of 
these  verification  measures  should  be  made  mandatory,  if  the  controls  are  to  be 
effective.  The  Comptroller  lead  review  discussed  under  recommendation  2  is 
expected  to  address  this  matter. 
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4.  Request  the  General  Services  Administration  to  modify  the  purchase 
card  contract  to  require  the  banks  to  block  purchases  from  businesses 
considered  inappropriate  by  DoD  organizations. 

Management  Comments.  The  Director,  Defense  Procurement  concurred  with 
the  intent  of  the  recommendation  and  stated  that  the  purchase  card  contract 
requires  the  banks  to  establish  specific  authorization  controls  as  requested  by  the 
agency  program  coordinator.  On  October  5,  2001,  the  Director,  Purchase  Card 
Joint  Program  Office,  directed  the  banks  to  initiate  authorization  controls  that 
would  decline  all  purchase  card  authorizations  at  merchants  identified  within  a 
group  of  twenty  specific  category  codes  considered  inappropriate.  Defense 
component  program  coordinators  were  advised  to  further  restrict  card  use  at 
certain  merchant  types  as  appropriate. 

We  recommend  that  the  Director,  Purchase  Card  Joint  Program 
Management  Office: 

5.  Direct  agency  program  coordinators  to  review  card  use  and  cancel 
unused  cards  or  perform  other  actions  that  would  protect  the  Government 
from  fraudulent  or  improper  use. 

Management  Comment.  The  Director,  Defense  Procurement  concurred  and 
stated  that  the  Program  Management  Office  is  in  the  process  of  advising  the 
Defense  Components  to  close  purchase  cards  that  are  no  longer  needed  and  to 
place  controls  over  valid  cards  that  are  infrequently  used  to  protect  the 
government  from  potential  cardholder  or  outside  fraudulent  use.  The  Program 
Management  Office  memorandum  will  be  issued  no  later  than  April  5,  2002. 

6.  Analyze  purchase  card  data  for  abnormal  occurrences  by  periodically 
reviewing  the  number  of  cardholders  assigned  to  an  approving  official. 
Require  agency  program  coordinators  to  research  and  resolve  the  following 
abnormal  occurrences: 

a.  approving  officials  without  cardholders,  and 

b.  cardholders  without  an  approving  official. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  DOD  billing  accounts  with  more  than  7  cardholders  were  identified 
and  provided  to  the  defense  components  for  corrective  action.  The  Program 
Management  Office  will  perform  this  analysis  on  a  semi-annual  basis.  In 
addition,  the  Program  Management  Office  corrective  action  identified  in 
recommendation  1  will  include  direction  for  the  coordinators,  on  a  semi-annual 
basis,  to  identify  and  cancel  billing  accounts  that  have  no  cardholders  or 
cardholder  accounts  not  attached  to  the  billing  accounts.  This  direction  will  be 
issued  no  later  than  April  5,  2002. 

7.  Identify,  research,  and  correct  inappropriate  separations  of  duties  when 
cardholders  are  allowed  to  be  approving  officials. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  cases  where  cardholders  are  their  own  billing  official  were  provided 
to  the  defense  component  program  coordinators  to  immediately  close  the  card 
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accounts.  The  Program  Management  Office  will  perform  another  review  in 
May  2002  to  ensure  all  of  these  situations  do  not  exist,  and  will  include  this 
occurrence  in  the  semi-annual  analysis  identified  in  recommendation  6. 

8.  Review  spending  limits  and  require  agency  program  coordinators  to 
perform  periodic  reviews  on  the  amount  of  purchases  made  by  cardholders 
and  to  adjust  purchase  limits  to  the  minimum  amount  justified  by  use. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  many  program  coordinators  use  “default”  limits  that  do  not 
accurately  reflect  their  needs  or  available  funding.  The  Director,  Defense 
Procurement  memo  dated  August  13,  2001,  directs  program  officials  to  set 
reasonable  single  purchase  and  monthly  spending  limits  based  on  what  the 
person  needs  to  buy  as  part  of  his/her  job.  Spending  limits  can  be  established 
on  cards  by  either  using  the  cardholder  spending  limits  or  the  billing  account 
limit. 

Audit  Response.  The  August  13,  2001  guidance  suggested  components 
perform  frequent  spot  checks  of  the  recommended  internal  controls.  The 
occurrence  of  these  verification  measures  must  be  made  mandatory,  if  the 
controls  are  to  be  effective.  The  Comptroller  lead  review  discussed  under 
recommendation  2  is  expected  to  address  this  matter. 

9.  Require  agency  program  coordinators  to  reconcile  spending  limits  in  the 
U.S.  Bank  and  Citibank  computer  systems  with  DoD  requested  limits  and 
resolve  discrepancies  quarterly. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  the  coordinators  will  be  directed  to  review  spending  limits  in  the  bank 
authorization  system  to  ensure  they  are  accurate.  This  direction  will  be  issued 
no  later  than  April  5,  2002.  This  review  may  be  conducted  as  part  of  the 
review  of  cardholder/billing  accounts. 

Audit  Response.  In  addition  to  the  review,  discrepancies  must  be  resolved. 

The  occurrence  of  these  measures  must  be  made  mandatory,  if  the  guidance  is  to 
be  effective.  The  Comptroller  lead  review  discussed  under  recommendation  2  is 
expected  to  address  this  matter. 

10.  Identify  and  investigate  accounts  when  cardholders  attempt  to  make 
purchases  after  banks  repeatedly  declined  to  process  purchases. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  it  is  in  the  process  of  advising  the  program  coordinators  to  review 
cardholders  with  large  numbers  of  declines  to  determine  if  they  are  attempting 
to  circumvent  internal  controls.  The  Program  Management  Office  memorandum 
will  be  issued  no  later  than  April  5,  2002. 

11.  Coordinate  with  the  banks  and  modify  the  purchase  card  contract  to 
include  procedures  that  prevent  card  accounts  from  being  reopened  after 
notification  of  closure  by  the  agency  program  coordinator.  Procedures 
developed  should  address  treatment  of  possibly  legitimate  charges  which 
may  be  posted  after  closing  of  the  account. 
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Management  Comments.  The  Program  Management  Office  non-concurred 
and  stated  that  card  accounts  are  not  “reopened”  to  accept  trailing  transactions. 
The  purchase  card  program  makes  use  of  standard  commercial  credit  card 
platforms,  processes  and  business  rules.  Transactions  can  post  to  cardholder 
accounts  as  long  as  six  months  after  the  cardholder  makes  a  purchase.  This  is 
due  to  the  card  association  requirement  that  vendors  cannot  charge  the  card  until 
shipment.  If  card  accounts  change,  it  is  unfair  to  the  merchant  to  refuse  these 
otherwise  legitimate  charges  due  to  our  failure  to  properly  notify  the  vendor  of  a 
card  change.  If  the  charges  are  not  valid,  the  DoD  has  disputes  rights  and  will 
not  incur  liability  if  procedures  are  properly  followed.  For  merchants  who 
continually  charge  a  closed  account  after  being  notified  of  the  new  account 
number,  the  program  coordinator  can  direct  the  card-issuing  bank  to  “charge- 
back”  these  transaction  to  the  merchant.  The  charge-back  results  in  a  fee  to  the 
merchant  similar  to  a  returned  check  charge.  The  number  of  invalid  charges 
occurring  after  account  closure  has  been  found  to  be  minimal. 

Audit  Response.  Information  received  during  the  course  of  the  audit  from  both 
the  Program  Management  Office  and  the  US  Bank  indicate  that  purchase  card 
accounts  can  be  “soft  closed”  instead  of  terminated.  Being  “soft  closed”  allows 
the  account  to  be  reopened.  In  one  case  an  account  had  been  closed  for  over  a 
year  when  a  merchant  processed  a  charge  against  the  “closed”  account.  The 
vendor  had  charged  the  account  in  error.  If  the  government  is  going  to  use  bank 
practices,  it  is  customary  for  vendors  to  call  in  credit  card  requests  to  get  an 
authorization  number  prior  to  making  a  charge.  We  believe  it  is  unfair  to  have 
to  pick  up  the  tab  for  charges  against  closed  accounts.  Charges  are  not  allowed 
to  individual  credit  card  accounts  once  closed;  the  merchant  gets  a  decline  from 
the  credit  card  company.  The  Director,  Defense  Procurement  should  reconsider 
its  position  on  Recommendation  1 1  and  provide  additional  comments  in 
response  to  the  final  report. 

12.  Review  purchase  card  data  to  identify  convenience  checks  written  in 
amounts  greater  than  $2,500  or  for  inappropriate  purposes.  Take  the 
following  actions: 

a.  Reemphasize  DoD  guidance  concerning  what  payments  can  and 
cannot  be  made  using  convenience  checks. 

b.  Require  agency  program  coordinators  to  research  convenience 
check  transactions  and  to  take  appropriate  actions  to  correct  improper  uses 
of  the  checks. 

c.  Request  that  the  General  Services  Administration  amend  the 
purchase  card  contract  to  state  that  convenience  checks  not  written  in 
accordance  with  the  DoD  Financial  Management  Regulation  will  not  be 
honored. 

Management  Comments.  The  Program  Management  Office  concurred  in  part 
and  stated  that  guidance  will  be  issued  to  the  Components  reminding  these 
organizations  that  their  program  reviews  (both  agency  program  coordinator  and 
heads  of  contracting)  shall  include  an  examination  of  convenience  check 
transactions  to  ensure  that  program  officials  are  complying  with  governing 
financial  management  and  acquisition  regulations.  In  addition,  the  Program 
Management  Office  will  continue  periodic  screening  of  convenience  check 
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transactions  to  identify  those  activities  that  are  writing  checks  in  excess  of  the 
$2,500  threshold.  The  Program  Management  Office  will  cancel  check  accounts 
for  activities  with  repeated  violations. 

The  purchase  card  program  makes  use  of  standard  commercial  convenience 
check  platforms,  processes  and  business  rules.  The  commercial  platform  does 
not  have  a  system  of  authorizations  that  could  limit  the  writing  of  the  check  at 
the  merchant  location.  Additionally,  the  Financial  Management  Regulation 
allows  checks  to  be  written  up  to  $10,000  in  support  of  a  contingency. 
Identification  of  appropriateness  of  the  check  cannot  be  accomplished  in  time  to 
void  payment  therefore,  the  most  efficient  and  economical  procedures  to  use 
would  be  the  post  review/justification  which  is  currently  in  place. 

Audit  Response.  The  DoD  Financial  Management  regulation  states  that 
convenience  checks  are  not  to  be  written  over  $2,500  unless  it  is  a  payment  in 
an  overseas  transaction  in  support  of  a  contingency,  then  it  can  be  written  up  to 
$10,000.  However,  according  to  bank  representatives,  a  foreign  draft  would  be 
used,  not  a  convenience  check.  Standard  commercial  convenience  check 
platforms  allow  for  convenience  checks  to  be  returned  for  insufficient  funds, 
especially  since  the  checks  state  that  they  are  not  valid  for  over  $2,500. 
Implementing  the  recommendation  would  allow  the  banks  to  return  the  checks 
and  avoid  potentially  fraudulent  checks.  The  Director,  Defense  Procurement 
should  reconsider  its  position  on  Recommendation  12.c.  and  provide  additional 
comments  in  response  to  the  final  report. 

13.  Identify  convenience  checks  written  to  individuals  and  require  agency 
program  coordinators  to  research  the  transactions.  Follow  up  with  agency 
program  coordinators  to  ensure  appropriate  corrective  actions  are 
performed. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  program  reviews  will  include  a  “spot  check”  examination  of 
convenience  checks  written  to  individuals  to  ensure  that  these  transactions  are 
legal,  proper,  and  correct.  While  it  may  be  entirely  appropriate  to  write  a 
convenience  check  to  an  individual  such  as  a  chapel  organist  or  guest  speaker 
who  does  not  accept  the  purchase  card,  controls  should  be  in  place  to  ensure 
appropriateness  of  the  checks. 

14.  Require  all  DoD  organizations  to  provide  reports  on  the  results  of 
oversight  reviews  and  provide  guidance  to  effect  corrective  actions  as 
needed. 

Management  Comments.  The  Program  Management  Office  concurred  and 
stated  that  the  Defense  Components  are  required  to  conduct  installation/base 
level  reviews  at  least  annually.  Depending  upon  the  Component,  the  results  of 
these  reviews  are  reported  to  either  the  installation/base  commander  or  the  local 
head  of  contracting.  In  turn,  components  are  to  report  material  control 
weaknesses  thorough  command  channels  to  DoD.  In  addition,  in  separate 
memoranda  dated  August  13,  and  14,  2001,  respectively,  the  Director  of 
Defense  Procurement  requested  audit  community  assistance  in  this  area.  The 
memorandum  includes  a  request  that  Military  Departments  and  Defense 
agencies  perform  spot  checks  on  internal  controls,  to  include  using  audit 
organizations  and  the  inspectors  general  to  assist.  The  August  14  memorandum 
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requested  assistance  from  the  IG,  DoD,  organization  in  obtaining  audit  results 
on  the  purchase  card  program  to  assist  with  managing  the  program,  tracking 
fraud  and  identifying  trends  of  misuse.  We  believe  that  the  reviews  (and 
associated  audit  plans)  conducted  by  the  Component  audit  organizations  and  the 
IG,  DoD,  should  also  include  an  examination  of  the  integrity,  the  quality  and 
the  completeness  of  the  installation/base  level  reviews.  The  Program 
Management  Office  would  then  make  use  of  the  resulting  audit  reports  and 
recommendations  to  determine  if  existing  policy  and/or  internal  control 
measures  should  be  amended  or  strengthened. 

Audit  Response.  The  audit  and  investigative  community  has  agreed  to  work 
with  the  Director,  Defense  Procurement  and  the  Comptroller  lead  taskforce  to 
identify  corrective  actions  to  improve  the  credit  card  program.  This  effort  is  not 
intended  to  be  a  replacement  for  oversight  by  the  departmental  management, 
however.  Currently  the  results  of  the  oversight  reviews  are  rarely  reported  up 
the  chain-of-command  and  senior  DoD  managers  lack  visibility  over  actual 
operations  of  the  purchase  card  program.  The  Air  Force  and  Defense  Logistics 
Agency  were  the  only  DoD  components  that  had  reported  purchase  cards  as  a 
material  weakness,  despite  the  efforts  of  the  audit  and  investigative  community 
to  bring  instances  of  internal  control  violations  to  command  attention  throughout 
the  DoD. 
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Appendix  A.  Audit  Process 


Scope 


Work  Performed.  We  examined  the  controls  for  issuing  and  using  231,856 
DoD  purchase  cards  in  FY  2001.  In  addition,  we  reviewed  12,008  convenience 
checks  written  between  October  1999  and  May  2001.  We  selectively  reviewed 
the  controls  over  the  processing  of  more  than  10.6  million  purchases,  by  card  or 
check,  amounting  to  $6.1  billion  in  FY  2001. 

Selection  of  Purchase  Card  Data.  We  selected  and  reviewed  automated 
purchase  card  data  provided  for  the  months  of  February  and  May  2001  by  the 
U.S.  Bank  and  Citibank.  The  two  banks  processed  954,002  transactions 
amounting  to  $488.3  million  during  February  2001,  and  994,919  transactions 
totaling  $528,981,656  during  May  2001.  In  addition,  we  reviewed  12,008 
convenience  checks  written  between  October  1999  and  May  2001,  totaling 
$27,389,557.  Using  these  data,  we  evaluated  controls  over  issuing  and  using 
purchase  cards  as  well  as  the  processing  of  purchases. 

Reviews  at  Organizations.  We  interviewed  personnel  in  the  Army  Materiel 
Command;  Naval  Sea  Systems  Command;  Air  Combat  Command; 

Headquarters,  Marine  Corps;  the  Defense  Contracting  Command-Washington; 
and  the  Air  Force  1st  Fighter  Wing  to  evaluate  controls  over  issuing  and  using 
cards.  In  addition,  we  interviewed  personnel  at  the  Purchase  Card  Joint 
Program  Management  Office. 

We  also  interviewed  personnel  at  Fort  Bragg,  North  Carolina;  Fort  Campbell, 
Kentucky;  Fort  Sam  Houston,  Texas;  Air  Force  Academy  in  Colorado  Springs, 
Colorado;  Robbins  Air  Force  Base,  Georgia;  Lackland  Air  Force  Base, 

San  Antonio,  Texas;  Bolling  Air  Force  Base,  Washington,  D.C.;  Aberdeen 
Proving  Grounds,  Maryland;  Washington  Aqueduct,  Washington,  D.C.;  and  the 
U.S.  Army  Reserve  Command,  Garden  Grove,  California.  These  interviews 
included  an  evaluation  on  the  validity  of  95  of  229  transactions  processed  for 
businesses  that  should  have  been  blocked.  These  transactions  occurred  between 
October  1999  and  July  2001. 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  DoD.  This  report  provides  coverage 
in  the  Acquisition  Management  high-risk  area. 

Methodology 


Use  of  Computer-Processed  Data.  To  achieve  the  audit  objective,  we 
extensively  relied  on  computer-processed  data  provided  by  Citibank  and  the 
U.S.  Bank  from  the  Citidirect  and  the  Customer  Automated  and  Reporting 
Environment  systems.  We  applied  data  mining  techniques  to  evaluate  controls 
over  issuing  and  using  purchase  cards,  as  well  as  the  processing  of  purchase 
card  payments.  Data  mining  assisted  on  this  audit  with  discovering  previously 
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unknown  relationships  among  the  data.  For  example,  we  identified  abnormal 
occurrences  such  as: 

•  approving  officials  without  cardholders, 

•  cardholders  without  an  approving  official,  and 

•  cardholders  with  more  than  one  approving  official. 

Although  we  did  not  perform  a  formal  reliability  assessment  of  the  computer- 
processed  data,  we  found  some  inconsistencies.  Single  micro-purchase  and 
monthly  spending  limits  for  some  cardholders  were  not  correct  in  the  bank 
systems.  However,  we  did  not  find  errors  that  would  preclude  use  of  the 
computer-processed  data  to  meet  the  audit  objective  or  that  would  change  the 
conclusions  in  this  report. 

Use  of  Technical  Assistance.  We  received  technical  assistance  from  the 
Information  Systems  Directorate  within  the  IG,  DoD,  Office  of  Administration 
and  Information  Management.  Information  Systems  Directorate  personnel 
loaded  purchase  card  data  from  the  banks  on  the  IG,  DoD,  mid-tier  computer. 
In  addition,  Information  Systems  Directorate  personnel  provided  computer 
software  that  aided  in  performing  queries  of  the  purchase  card  data. 

We  also  received  technical  assistance  from  the  Defense  Manpower  Data  Center 
The  Defense  Manpower  Data  Center  performed  computer  searches  to  identify 
purchases  that  should  have  been  blocked,  purchases  made  by  cardholders  that 
approved  their  own  bills  for  payment,  and  purchases  made  using  convenience 
checks.  The  Defense  Manpower  Data  Center  also  provided  us  with  cardholder 
and  transaction  data  for  February  and  May  2001 . 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  January  2001  through  January  2002  in  accordance  with 
generally  accepted  government  auditing  standards. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD  and  within  the  General  Services  Administration, 
General  Accounting  Office,  U.S.  Bank,  and  Citibank.  Further  details  are 
available  on  request. 

Management  Control  Program  Review 


DoD  Directive  5010.38,  “Management  Control  (MC)  Program,” 

August  26,  1996,  and  DoD  Instruction  5010.40,  “Management  Control  (MC) 
Program  Procedures,”  August  28,  1996,  require  DoD  organizations  to 
implement  a  comprehensive  system  of  management  controls  that  provides 
reasonable  assurance  that  programs  are  operating  as  intended  and  to  evaluate  the 
adequacy  of  the  controls. 

Scope  of  the  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  controls  over  the  issuance  and  use  of  purchase  cards  at  the  Army 
Materiel  Command;  Naval  Sea  Systems  Command;  Air  Combat  Command; 
Headquarters,  Marine  Corps;  Defense  Contracting  Command-Washington;  Air 
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Force  1st  Fighter  Wing;  and  the  DoD  Purchase  Card  PMO.  We  reviewed 
FY  2000  annual  statements  of  assurance  required  by  the  Federal  Managers 
Financial  Integrity  Act  of  1982  for  the  Army,  Navy,  Air  Force,  other  Defense 
organizations,  and  the  DoD-wide  statement  of  assurance. 

We  also  reviewed  management  controls  at  Fort  Bragg,  North  Carolina;  Fort 
Campbell,  Kentucky;  Fort  Sam  Houston,  Texas;  Air  Force  Academy  in 
Colorado  Springs,  Colorado;  Robbins  Air  Force  Base,  Georgia;  Lackland  Air 
Force  Base,  San  Antonio,  Texas;  Bolling  Air  Force  Base,  Washington,  D.C.; 
Aberdeen  Proving  Grounds,  Maryland;  Washington  Aqueduct,  Washington, 
D.C.;  and  the  U.S.  Army  Reserve  Command,  Garden  Grove,  California,  to 
evaluate  the  validity  of  transactions  processed  for  businesses  that  should  have 
been  blocked. 

Adequacy  of  Management  Controls.  We  identified  material  management 
control  weaknesses  related  to  the  purchase  card  program  as  defined  by  DoD 
Instruction  5010.40.  Controls  over  the  purchase  card  program  at  some  DoD 
organizations  visited  or  contacted  were  not  adequate  to  provide  reasonable 
assurance  that  sufficient  or  effective  internal  controls  existed. 

Specifically,  we  verified  that  management  control  weaknesses  existed  with 
cardholders  serving  as  their  own  approving  official  at  the  Army  Physical 
Disability  Agency  at  Walter  Reed  Army  Medical  Center,  Washington,  D.C.;  the 
Defense  Security  Service  in  Linthicum  Heights,  Maryland;  the  Joint  Regional 
Medical  Planning  Office  and  the  public  affairs  office  at  Fort  Meade,  Maryland; 
and  the  Office  of  Special  Investigations  at  Andrews  Air  Force  Base,  Maryland. 

Also,  convenience  checks  were  written  for  amounts  greater  than  $2,500  at  the 
Defense  Attache  Training  Service  in  Arlington,  Virginia.  In  addition, 
approving  officials  were  responsible  for  more  than  100  cardholder  accounts  at 
the  Army  Medical  Research  Acquisition  Activity  at  Walter  Reed  Army  Institute 
of  Research,  Forest  Glen,  Maryland,  and  the  Naval  Surface  Warfare  Center, 
Indian  Head,  Maryland.  Further,  questionable  purchases  were  made  at  the 
National  Naval  Medical  Center,  Bethesda,  Maryland. 

Recommendations  in  this  report,  if  implemented,  will  improve  controls  over  the 
purchase  card  program  by  assisting  in  meeting  the  goals  of  the  program  and 
ensuring  that  the  cards  were  being  used  appropriately  and  efficiently;  and  that 
fraud,  waste,  and  misuse  were  kept  to  a  minimum.  A  copy  of  the  report  will  be 
sent  to  the  senior  official  in  charge  of  management  controls  for  the 
USD(AT&L). 

Adequacy  of  Management’s  Self-Evaluation.  The  PMO  officials  did  not 
perform  a  self-evaluation  and,  therefore,  did  not  identify  or  report  the  material 
management  control  weaknesses  identified  by  the  audit.  However,  the 
Air  Force  and  the  Defense  Logistics  Agency  reported  a  material  control 
weakness  in  the  purchase  card  program. 

Air  Force.  The  Air  Force  reported  that  its  agency  program  coordinators 
did  not  perform  the  required  annual  reviews  on  cardholder  accounts.  The  Air 
Force  took  corrective  action  by  implementing  Air  Force  Instruction  64-117, 

“Air  Force  Purchase  Card  Program,”  dated  December  6,  2000,  which  requires 
approving  officials  to  perform  100  percent  reviews  every  12  months. 
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Defense  Logistics  Agency.  The  Defense  Logistics  Agency  reported  that 
an  employee  within  its  Document  and  Automation  Production  Service  had 
misused  a  purchase  card.  The  Agency  took  corrective  actions  by  implementing 
a  self-inspection  program,  organization-wide  procedures  to  train  and  direct 
purchase  cardholders  and  approving  officials,  and  an  internal  review  program. 

DoD-Wide  Controls  Over  Purchase  Cards.  Although  the  Air  Force  and  the 
Defense  Logistics  Agency  identified  weaknesses  in  the  purchase  card  program, 
the  PMO  had  not  identified  weaknesses  in  the  system  of  controls  within  the  DoD 
program,  as  cited  in  this  audit  report.  The  PMO  stated  that  its  staff  consisted  of 
only  nine  employees  and  that  the  DoD  organizations  had  management  control 
program  officers  to  ensure  compliance  with  established  regulations  and  policies. 

Prior  Coverage 


During  the  past  7  years.  Congressional  committees,  GAO,  and  DoD  audit 
organizations  have  issued  numerous  reports  discussing  the  DoD  purchase  card 
program. 

General  Accounting  Office.  The  GAO  issued  four  reports  relating  to  the  DoD 
purchase  card  program.  The  most  recent  report,  GAO  Report  No. 
GAO-02-506T,  “Purchase  Cards:  Continued  Control  Weaknesses  Leave  Two 
Navy  Units  Vulnerable  to  Fraud  and  Abuse,”  issued  on  March  13,  2002,  was  a 
followup  of  GAO  Report  No.  GAO-01-995T,  “Purchase  Cards:  Control 
Weaknesses  Leave  Two  Navy  Units  Vulnerable  to  Fraud  and  Abuse,”  issued  on 
July  30,  2001.  Both  reports  were  issued  as  testimony  before  the  Subcommittee 
on  Government  Efficiency,  Financial  Management,  and  Intergovernmental 
Relations,  Committee  on  Government  Reform,  House  of  Representatives.  GAO 
reports  can  be  accessed  on  the  Internet  at  http://www.gao.gov. 

DoD  Audit  Organizations.  The  IG,  DoD,  and  audit  organizations  in  the 
Military  Departments  and  Defense  agencies  issued  more  than  300  reports  on 
purchase  cards  between  FYs  1996  and  2001.  IG,  DoD,  Report  No.  D-2002- 
029,  “Summary  of  DoD  Purchase  Card  Program  Audit  Coverage,” 

December  27,  2001,  identified  systemic  issues  with  the  program.  Also, 
IG,DoD,  Report  No.  D-2002-065,  “Summary  of  DoD  Travel  Card  Program 
Audit  Coverage,”  March  18,  2002,  identified  systemic  weaknesses  in  the  travel 
card  program. 

Inspector  General,  DoD,  reports  can  be  accessed  on  the  Internet  at 
http://www.dodig.osd.mil/audit/reports.  The  Military  Departments  and  other 
Defense  organizations’  reports  can  be  viewed  from  the  DoD  Internet  website  at 
http :  //www .  defenselink .  mil/ . 
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Appendix  B.  Organization  of  the  DoD  Purchase 

Card  Program 


DoD  Joint  Purchase  Card  Program 
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Appendix  C.  Approving  Officials  Responsible  for 

More  Than  100  Cardholder 
Accounts  * 


DoD  Activity 

Major  Command 

Number  of 
Approving 
Officials 

Army 

Headquarters  Forces  Command 

5 

U.S.  Army  Training  and  Doctrine  Command 

1 

Medical  Command 

1 

U.S.  Army  Corp  of  Engineers 

1 

Army  Medical  Research  Acquisition  Activity 

1 

National  Guard  Bureau 

12 

Navy 

Naval  Sea  Systems  Command 

2 

Bureau  of  Medicine  and  Surgery 

1 

Air  Force 

Air  Force  Services  Squadron  (Nonappropriated 

Funds) 

1 

Air  Force  Education  and  Training  Command 

1 

U.S.  Air  Force  Academy 

1 

Service  Squadron 

1 

Defense 

Organizations 

On-Site  Inspection  Agency 

1 

Defense  Micro  Electronics  Activity 

1 

Defense  Information  Technology  Contracting  Officer 

1 

Total 

31 

"Data  in  this  chart  were  current  as  of  May  2001. 
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Appendix  D.  Cardholders  Authorized  to  Approve 

and  Certify  Their  Own  Payments* 


Agency 


Army _ 


Major  Command 

Number  of 
Accounts 

Defense  Contracting  Command  -  Washington 

3 

National  Guard  Bureau 

5 

U.S.  Army  Combined  Forces  Command  -  National  Capital 

8 

Army  Materiel  Command 

3 

Military  District  Washington 

3 

Army  Corps  of  Engineers 

3 

Training  and  Doctrine  Command 

2 

Army  Southern  Command 

5 

Headquarters  Forces  Command 

12 

Army  Contracting  Command  Europe 

1 

Office  of  Chief  of  Chaplains 

3 

National  Guard  Bureau 

13 

Medical  Command 

1 

Chief  of  Naval  Operations 

2 

Bureau  of  Medicine 

13 

Naval  Air  Systems  Command 

1 

Bureau  of  Naval  Personnel 

3 

Naval  Sea  Systems  Command 

1 

Marine  Corps 

1 

Atlantic  Fleet 

11 

Navy/Marine  Corps 

4 

Navy  Special  Warfare  Command 

1 

Air  Force  Space  Command 

14 

Air  Force  Materiel  Command 

4 

Air  Mobility  Command 

10 

Pacific  Air  Force 

2 

Air  Force  Services  (Nonappropriated  Fund  Organizations) 

5 

Air  Force  Europe 

3 

Raytheon  Support  Services 

1 

Air  Education  and  Training  Command 

2 

Air  Force  Reserve 

2 

Air  Combat  Command 

3 

Air  Force  Chaplain  Services 

2 

Defense  Finance  and  Account  Service 

3 

Defense  Logistics  Agency 

2 

Defense  Contract  Management  Agency 

1 

Defense  Intelligence  Agency 

3 

Total 

156 

34 


Appendix  E.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Director,  Defense  Procurement 

Director,  Purchase  Card  Joint  Program  Management  Office 
Director  for  Acquisition  Initiatives 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 
Commander,  Army  Materiel  Command 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Naval  Inspector  General 

Auditor  General,  Department  of  the  Navy 

Commandant  of  the  Marine  Corps 

Commander,  Naval  Sea  Systems  Command 

Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Air  Force 

Commander,  Air  Combat  Command 

Commander,  First  Fighter  Wing,  Langley  Air  Force  Base 


Other  Defense  Organizations 

Director,  Defense  Commissary  Agency 
Director,  Defense  Contract  Management  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Intelligence  Agency 
Director,  Defense  Logistics  Agency 
Director,  Missile  Defense  Agency 
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Other  Defense  Organizations  (con’t) 

Director,  Defense  Threat  Reduction  Agency 

Director,  National  Imagery  and  Mapping  Agency 

Director,  Defense  Contacting  Command-Washington 

Director,  DoD  Education  Activity 

Director,  Washington  Headquarters  Services 

President,  Uniformed  Services  University  of  the  Health  Sciences 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International  Relations, 
Committee  on  Government  Reform 

House  Subcommittee  on  Technology  and  Procurement  Policy,  Committee  on  Government 
Reform 
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Under  Secretary  of  Defense,  Acquisition, 
Technology,  and  Logistics  Comments 


ACQUISITION, 
TECHNOLOGY 
AND  LOGISTICS 


DP(EB) 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 

3000  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-3000 


MAR  2  2  2002 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  (DODIG) 


THROUGH:  DIRECTOR,  ACQUISITION  RESOURCES  AND  ANALYSIS  ' 

SUBJECT:  Audit  Report  on  Controls  Over  the  DOD  Purchase  Card  Program, 
D2001FG-0068 


This  memorandum  provides  our  comments  regarding  the  findings  and 
recommendations  of  the  subject  draft  report.  We  generally  concur  with  the  audit  findings 
and  the  intent  of  all  the  recommendations.  For  clarification  purposes,  a  discussion  on  the 
application  of  spending  limits  as  an  authorization  control  and  the  inconsistency  between 
the  bank’s  reporting  system  and  their  authorization  controls  is  discussed  at  the  beginning 
of  the  attached  comments  relative  to  the  specific  recommendations. 

Please  direct  questions  regarding  our  comments  to  the  program  manager,  Bruce 
Sullivan  at  (703)  681-7564  or  my  action  officer,  Melissa  Rider  at  (703)  695-1098. 


Deidre  A.  Lee 

Director,  Defense  Procurement 


Attachment: 
As  stated 
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DRAFT  AUDIT  REPORT  DATED  FEBRUARY  28, 2002 
D2001FG-0068 

“CONTROLS  OVER  THE  DOD  PURCHASE  CARD  PROGRAM” 
DEPARTMENT  OF  DEFENSE  COMMENTS 


GENERAL  COMMENTS  ON  FINDINGS  AND  RECOMMENDATIONS:  The 
findings  in  the  report  on  spending  limits  may  not  be  accurate  in  all  cases.  The 

findings  may  have  misrepresented  actual  limits  because  the  auditor  did  not  review 
cardholder  and  billing  account  limits  together  and,  the  report  provided  by  the  bank 
showing  spending  limits  was  inaccurate. 

Evaluating  spending  controls  at  the  cardholder  level  alone,  or  referencing  the  credit  limit  ^ 
can  misrepresent  actual  controls  over  the  card.  Limits  may  be  imposed  at  three  levels — 
at  the  cardholder  individual  purchase  level,  at  the  cardholder  monthly  limit  level  and  at 
the  billing  official/  activity  monthly  limit  level.  The  limits  at  the  billing  official/  activity 
level  provide  controls  that  would  prevent  overextension  cited  in  the  draft  report. 
Therefore,  there  are  strong  controls  in  place  for  purchase  limits. 

U.S.  Bank  provided  the  IG  with  a  report  that  did  not  accurately  portray  spending  limits  in 
the  Bank’s  authorization  system.  We  advised  the  bank  and  the  DoDIG  of  this  situation. 
The  bank  subsequently  corrected  the  problem  (table  not  being  updated  with  actual 
authorization  controls)  and  the  report  now  accurately  reflects  spending  controls  in  the 
banks  authorization  process. 

COMMENTS  ON  SPECIFIC  RECOMMENDATIONS: 

RECOMMENDATION  1:  Coordinate  with  the  USD(C)  and  review  DOD  policies  and 
procedures  to  address  internal  control  weaknesses  identified  in  this  report.  Develop 
written  guidelines  for  DOD  organizations  to  use  for  issuing  and  using  purchase  cards,  and 
the  processing  of  purchases  and  convenience  checks. 
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USD(AT&L)  RESPONSE:  Concur.  As  a  result  of  the  DoDIG  findings,  the  Purchase 
Card  Joint  Program  Management  Office  (PMO)  and  the  Office  of  the  Director  for 
Defense  Procurement  reviewed  Department  policies  for  internal  control  weaknesses.  As 
a  result,  and  on  July  5,  2001,  the  PMO  issued  a  memorandum  subject  Internal  and 
Management  Controls  to  all  defense  components.  The  PMO  coordinated  the 
memorandum  with  the  Office  of  Under  Secretary  of  Defense  (Comptroller). 

Additionally,  on  August  13, 2001,  the  Director  for  Defense  Procurement  issued  a 
memorandum,  subject;  Government  Purchase  Card  Internal  Controls,  to  Directors  Of 
Defense  Agencies  and  Deputy  Assistant  Secretaries  Of  The  Military  Services  directing 
that  they  ensure  cards  are  issued  only  to  personnel  with  a  continuing  need  to  purchase 
goods  or  services  as  part  of  their  duties.  On  March  12,  the  Under  Secretary  of  Defense 
(Comptroller)  and  the  Under  Secretary  of  Defense  for  Acquisition,  Technology,  and 
Logistics  jointly  signed  a  memorandum  emphasizing  Department  policies  and  internal 
controls  for  the  purchase  card.  Finally,  the  PMO  is  in  the  process  of  advising  the  Defense 
Components  to  close  purchase  cards  that  are  no  longer  needed  and  to  place  controls  over 
valid  cards  that  are  infrequently  used  to  protect  the  government  from  potential  cardholder 
or  outside  fraudulent  use.  The  PMO  memorandum  will  be  issued  no  later  than 
April  5,  2002. 

RECOMMENDATION  2:  Develop  standardized  training  for  the  purchase  card  program. 
Coordinate  with  the  Undersecretary  of  Defense  (Comptroller)  on  updating  the  DoD 
Financial  Management  Regulation  with  the  requirement  for  purchase  card  training. 

USD(AT&L)  RESPONSE;  Concur.  The  requirement  for  training  cardholders  is 
currently  in  existence  in  the  Federal  Acquisition  Regulation  and  the  Defense  Supplement. 
In  addition,  the  PMO  is  completing  efforts  on  an  interactive  purchase  card  training 
module  for  the  DOD.  The  Defense  Acquisition  University  contracted  for  its  completion 
and  the  course  is  scheduled  to  be  on-line  by  mid  July  2002  In  addition,  as  part  of  a 
Comptroller  led  review  of  the  Travel  Card  and  Purchase  Card  Programs  in  March  2002, 
both  regulatory  guidance  and  training  adequacy  are  being  assessed.  Final 
recommendations  are  forthcoming  and  are  expected  to  further  address  this 
recommendation . 

RECOMMENDATION  3:  Distribute  guidance  for  issuing  purchase  cards  that  includes  a 
methodology  for  use  by  agency  program  coordinators  in  establishing  spending  limits  for 
cardholders  and  approving  officials.  Require  single  purchase  limits  for  all  cardholders. 

DPP  RESPONSE:  Concur.  The  DDP  memo  of  August  13,  2001,  advised  the  Defense 
Components  to  set  cardholder  spending  limits  and/or  billing  account  spending  limits 
based  on  cardholder  projected  needs  and  available  funds. 
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RECOMMENDATION  4:  Request  the  General  Services  Administration  to  modify  the 
purchase  card  contract  to  require  the  banks  to  block  purchases  from  businesses 
considered  inappropriate  by  DOD  organizations. 

DPP  RESPONSE:  Concur  with  concept.  The  purchase  card  contract  currently  requires 
the  banks  to  block  purchases  from  businesses  considered  inappropriate  by  DOD 
organizations.  Section  C.30,  AUTHORIZATION  CONTROLS,  requires  the  banks  to 
establish  specific  authorization  controls  as  requested  by  the  agency  program  coordinator. 
On  October  5,  2001,  the  Director,  Purchase  Card  Joint  Program  Office,  directed  the 
banks  to  initiate  authorization  controls  that  would  decline  all  purchase  card  authorizations 
at  merchants  identified  within  a  group  of  twenty  specific  category  codes  considered 
inappropriate.  Defense  component  program  coordinators  were  advised  to  further  restrict 
card  use  at  certain  merchant  types  as  appropriate 

RECOMMENDATION  5:  Direct  agency  program  coordinators  to  review  use  and  cancel 
unused  cards  or  perform  other  actions  that  would  protect  the  Government  from  fraudulent 
or  improper  use. 

DPP  RESPONSE:  Concur.  Director  of  Defense  Procurement  memorandum  dated 
August  13,  2001,  “Government  Purchase  Card  Internal  Controls”,  provided  direction  that 
only  those  personnel  with  a  continuing  need  to  purchase  goods  or  services  as  part  of  their 
job  should  be  cardholders.  Additionally,  the  corrective  action  being  taken  for 
recommendation  1  above  will  remedy  this  situation. 

RECOMMENDATION  6:  Analyze  purchase  card  data  for  abnormal  occurrences  by 
periodically  reviewing  the  number  of  cardholders  assigned  to  an  approving  official. 
Require  agency  program  coordinators  to  research  and  resolve  the  following  abnormal 
occurrences: 

a.  approving  officials  without  cardholders,  and 

b.  cardholders  without  an  approving  official. 

PMO  RESPONSE:  Concur.  The  PMO  identified  DOD  billing  accounts  with  more  than 
7  cardholders  and  provided  them  to  the  defense  components  for  corrective  action.  The 
PMO  will  perform  this  analysis  on  a  semi-annual  basis.  Additionally,  the  PMO  corrective 
action  identified  in  recommendation  1  will  include  direction  for  the  coordinators,  on  a 
semi-annual  basis,  to  identify  and  cancel  billing  accounts  which  have  no  cardholders  or 
cardholder  accounts  not  attached  to  billing  accounts. 

RECOMMENDATION  7:  Identify,  research,  and  correct  inappropriate  separation  of 
duties  when  cardholders  are  allowed  to  be  approving  officials. 


PMO  RESPONSE:  Concur.  The  PMO  identified  cases  where  cardholders  are  their  own 
billing  official  and  directed  the  defense  component  program  coordinators  to  immediately 
close  the  card  accounts.  The  PMO  will  perform  another  review  in  early  May  to  ensure  all 
of  these  situations  do  not  exist,  and  will  include  this  occurrence  in  the  semi-annual 
analysis  identified  in  recommendation  6  above. 

RECOMMENDATION  8:  Review  spending  limits  and  require  agency  program 
coordinators  to  perform  periodic  reviews  on  the  amount  of  purchases  made  by 
cardholders  and  to  adjust  purchase  limits  to  the  minimum  amount  justified  by  use. 

PMO  RESPONSE:  Concur.  We  concur  that  many  program  coordinators  use  “default” 
limits  which  do  not  accurately  reflect  their  needs  or  available  funding.  The  Director  of 
Defense  Procurement  memo  dated  August  13, 2001,  directs  program  officials  to  set 
reasonable  single  purchase  and  monthly  spending  limits  based  on  what  the  person  needs 
to  buy  as  part  of  his/her  job.  Spending  limits  can  be  established  on  cards  by  either  using 
the  cardholder  spending  limits  or  the  billing  account  limit. 

RECOMMENDATION  9:  Require  agency  program  coordinators  to  reconcile  spending 
limits  in  the  U.S.  Bank  and  Citibank  computer  systems  with  DoD  requested  limits  and 
resolve  discrepancies  quarterly. 

PMO  RESPONSE:  Concur.  The  PMO  corrective  action  identified  in  the  response  to 
recommendation  1  will  include  direction  for  the  coordinators  to  review  spending  limits  in 
the  bank  authorization  system  to  ensure  they  are  accurate.  This  review  may  be  conducted 
as  part  of  the  review  of  cardholder/billing  accounts. 

RECOMMENDATION  10:  Identify  and  investigate  accounts  when  cardholders  attempt 
to  make  purchases  after  the  bank’s  repeatedly  declined  to  process  purchases. 

PMO  RESPONSE:  Concur.  The  PMO  corrective  action  identified  in  the  response  to 
recommendation  1  will  require  program  coordinators  to  review  cardholders  with  large 
numbers  of  declines  to  determine  if  they  are  attempting  to  circumvent  internal  controls. 

RECOMMENDATION  11:  Coordinate  with  the  banks  and  modify  the  purchase  card 
contract  to  include  procedures  that  prevent  card  accounts  from  being  reopened  after 
notification  of  closure  by  the  agency  program  coordinator.  Procedures  developed  should 
address  treatment  of  possibly  legitimate  charges  that  may  be  posted  after  closing  of  the 
account. 

PMO  RESPONSE:  Non-concur.  Card  accounts  are  not  “reopened”  to  accept  trailing 
transactions.  The  purchase  card  program  makes  use  of  standard  commercial  credit  card 
platforms,  processes  and  business  rules.  Transactions  can  post  to  cardholder  accounts  as 
long  as  six  months  after  the  cardholder  makes  a  purchase.  This  is  due  to  the  card 
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association  requirement  that  vendors  cannot  charge  the  card  until  shipment.  If  card 
accounts  change,  it  is  unfair  to  the  merchant  to  refuse  these  otherwise  legitimate  charges 
due  to  our  failure  to  properly  notify  the  vendor  of  a  card  change.  If  the  charges  are  not 
valid,  the  DOD  has  disputes  rights  and  will  not  incur  liability  if  procedures  are  properly 
followed.  For  merchants  who  continually  charge  a  closed  account  after  being  notified  of 
the  new  account  number,  the  program  coordinator  can  direct  the  card-issuing  bank  to 
“charge-back”  these  transactions  to  the  merchant.  The  charge-back  results  in  a  fee  to  the 
merchant  similar  to  a  returned  check  charge.  The  number  of  invalid  charges  occurring 
after  account  closure  has  been  found  to  be  minimal. 

RECOMMENDATION  12:  Review  purchase  card  data  to  identify  convenience  checks 
written  in  amounts  greater  than  $2,500  or  for  inappropriate  purposes.  Take  the  following 
actions: 

a.  reemphasize  DoD  guidance  concerning  what  payments  can  and  cannot  be  made 
using  convenience  checks, 

b.  require  agency  program  coordinators  to  research  convenience  check  transactions 
and  to  take  appropriate  actions  to  correct  improper  uses  of  the  checks,  and 

c.  request  the  General  Services  Administration  amend  the  purchase  card  contract  to 
state  that  convenience  checks  not  written  in  accordance  with  the  DoD  Financial 
Management  regulation  (FMR)  will  not  be  honored. 

PMO  RESPONSE:  Partially  concur.  The  PMO  corrective  action  identified  in  the 
response  to  recommendation  1  will  include  guidance  to  the  Components  reminding  these 
organizations  that  their  program  reviews  (both  agency  program  coordinator  and  heads  of 
contracting)  shall  include  an  examination  of  convenience  check  transactions  to  ensure 
that  program  officials  are  complying  with  governing  financial  management  and 
acquisition  regulations.  In  addition,  the  PMO  will  continue  periodic  screening  of 
convenience  check  transactions  to  identify  those  activities  that  are  writing  checks  in 
excess  of  the  $2,500  threshold.  The  PMO  will  cancel  check  accounts  for  activities  with 
repeat  violations. 

The  purchase  card  program  makes  use  of  standard  commercial  convenience  check 
platforms,  processes  and  business  rules.  The  commercial  platform  does  not  have  a 
system  of  authorization  controls  which  could  limit  the  writing  of  the  check  at  the 
merchant  location.  Additionally,  the  Financial  Management  Regulation  allows  checks  to 
be  written  up  to  $10,000  in  support  of  a  contingency.  Identification  of  appropriateness  of 
the  check  cannot  be  accomplished  in  time  to  avoid  payment,  therefore,  the  most  efficient 
and  economical  procedure  to  use  would  be  the  post  review/justification  which  is  currently 
in  place. 


RECOMMENDATION  13:  Identify  convenience  checks  written  to  individuals  and 
require  agency  program  coordinators  to  research  the  transactions.  Follow  up  with  agency 
program  coordinators  to  ensure  appropriate  corrective  actions  are  performed. 

PMO  RESPONSE:  Concur.  The  PMO  will  request  that  program  reviews  include  a  “spot 
check”  examination  of  convenience  checks  written  to  individuals  to  ensure  that  these 
transactions  are  legal,  proper,  and  correct.  While  it  may  be  entirely  appropriate  to  write  a 
convenience  check  to  an  individual  such  as  a  chapel  organist  or  guest  speaker  who  does 
not  accept  the  purchase  card,  controls  should  be  in  place  to  ensure  appropriateness  of 
checks. 

RECOMMENDATION  14:  Require  all  DOD  organizations  to  provide  reports  on  the 
results  of  oversight  reviews  and  provide  guidance  to  effect  corrective  actions  as  needed. 

PMO  RESPONSE:  Concur.  Defense  Components  are  required  to  conduct 
installation/base  level  reviews  at  least  annually.  Depending  upon  the  Component,  the 
results  of  these  reviews  are  reported  tojj^either  the  installation/base  commander  or  the 
local  head  of  contracting.  In  turn,  components  are  to  report  material  control  weaknesses 
through  command  channels  to  DOD.  In  addition,  in  separate  memoranda  dated 
August  13  and  14,  2001  respectively,  the  Director  of  Defense  Procurement  requested 
audit  community  assistance  in  this  arena.  The  memorandum  includes  a  request  that 
Military  Departments  and  Defense  agencies  perform  spot  checks  on  internal  controls,  to 
include  using  audit  organizations  and  the  inspectors  general  to  assist.  The  August  14 
memorandum  requested  assistance  from  the  DoDIG  organization  in  obtaining  audit 
results  on  the  purchase  card  program  to  assist  with  managing  the  program,  tracking  fraud 
and  identifying  trends  of  misuse.  We  believe  that  the  reviews  (and  associated  audit 
plans)  conducted  by  the  Component  audit  organizations  and  the  DoDIG  should  also 
include  an  examination  of  the  integrity,  the  quality  and  the  completeness  of  the 
installation/base  level  reviews.  The  PMO  would  then  make  use  of  the  resulting  audit 
reports  and  recommendations  to  determine  if  existing  policy  and/or  internal  control 
measures  should  be  amended  or  strengthened. 
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